From: Tom St Denis tom.stdenis@amd.com
If a user tries to read a non-multiple of 4 bytes it would have read until the end of the ring potentially crashing the user task.
Signed-off-by: Tom St Denis tom.stdenis@amd.com Reviewed-by: Christian König christian.koenig@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com --- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c index 7e1bc73..1b0b7ae 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c @@ -379,7 +379,7 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf, int r, i; uint32_t value, result, early[3];
- if (*pos & 3) + if (*pos & 3 || size & 3) return -EINVAL;
result = 0;