| From 984060b86ac1601e3713e83209b5b0f77e0e34a8 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sat, 31 Aug 2019 21:25:36 +0200 |
| Subject: drm/amdgpu: Check for valid number of registers to read |
| |
| From: Trek <trek00@inbox.ru> |
| |
| [ Upstream commit 73d8e6c7b841d9bf298c8928f228fb433676635c ] |
| |
| Do not try to allocate any amount of memory requested by the user. |
| Instead limit it to 128 registers. Actually the longest series of |
| consecutive allowed registers are 48, mmGB_TILE_MODE0-31 and |
| mmGB_MACROTILE_MODE0-15 (0x2644-0x2673). |
| |
| Bug: https://bugs.freedesktop.org/show_bug.cgi?id=111273 |
| Signed-off-by: Trek <trek00@inbox.ru> |
| Signed-off-by: Alex Deucher <alexander.deucher@amd.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c |
| index 3938fca1ea8e5..24941a7b659f4 100644 |
| --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c |
| +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c |
| @@ -430,6 +430,9 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file |
| if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) |
| sh_num = 0xffffffff; |
| |
| + if (info->read_mmr_reg.count > 128) |
| + return -EINVAL; |
| + |
| regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL); |
| if (!regs) |
| return -ENOMEM; |
| -- |
| 2.20.1 |
| |
