diff options
| author | Trek <trek00@inbox.ru> | 2019-08-31 21:25:36 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-10-11 18:18:40 +0200 |
| commit | cc376abf178b7ddfb5f620a8a72d9fe048828203 (patch) | |
| tree | 8a52c70f5027166c6ab5a854d9e7c80318280de3 | |
| parent | 7059ce31266f364e3091b6a71179d7ac68cdb851 (diff) | |
| download | linux-stable-cc376abf178b7ddfb5f620a8a72d9fe048828203.tar.gz linux-stable-cc376abf178b7ddfb5f620a8a72d9fe048828203.tar.bz2 linux-stable-cc376abf178b7ddfb5f620a8a72d9fe048828203.zip | |
drm/amdgpu: Check for valid number of registers to read
[ Upstream commit 73d8e6c7b841d9bf298c8928f228fb433676635c ]
Do not try to allocate any amount of memory requested by the user.
Instead limit it to 128 registers. Actually the longest series of
consecutive allowed registers are 48, mmGB_TILE_MODE0-31 and
mmGB_MACROTILE_MODE0-15 (0x2644-0x2673).
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=111273
Signed-off-by: Trek <trek00@inbox.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c index e16229000a98..884ed359f249 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c @@ -540,6 +540,9 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) sh_num = 0xffffffff; + if (info->read_mmr_reg.count > 128) + return -EINVAL; + regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL); if (!regs) return -ENOMEM; |