diff mbox

[2/3] drm/amd/amdgpu: ring debugfs is read in increments of 4 bytes

Message ID 1464877517-28337-2-git-send-email-alexander.deucher@amd.com (mailing list archive)
State New, archived
Headers show

Commit Message

Alex Deucher June 2, 2016, 2:25 p.m. UTC 
From: Tom St Denis <tom.stdenis@amd.com>

If a user tries to read a non-multiple of 4 bytes it would have
read until the end of the ring potentially crashing the user
task.

Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox

Patch

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index 7e1bc73..1b0b7ae 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -379,7 +379,7 @@  static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf,
 	int r, i;
 	uint32_t value, result, early[3];
 
-	if (*pos & 3)
+	if (*pos & 3 || size & 3)
 		return -EINVAL;
 
 	result = 0;