diff options
| author |   Trek <trek00@inbox.ru> | 2019-08-31 21:25:36 +0200 |
|---|---|---|
| committer |   Alex Deucher <alexander.deucher@amd.com> | 2019-09-16 10:42:56 -0500 |
| commit | 13238d4fa6764fa74dcf863d5f2227765b3753eb (patch) | |
| tree | e9fd7081de784563e3a5ffd52c8239bfbd5e7102 /drivers/gpu | |
| parent | drm/radeon: Bail earlier when radeon.cik_/si_support=0 is passed (diff) | |
| download | linux-dev-13238d4fa6764fa74dcf863d5f2227765b3753eb.tar.xz linux-dev-13238d4fa6764fa74dcf863d5f2227765b3753eb.zip | |
drm/amdgpu: Check for valid number of registers to read
Do not try to allocate any amount of memory requested by the user.
Instead limit it to 128 registers. Actually the longest series of
consecutive allowed registers are 48, mmGB_TILE_MODE0-31 and
mmGB_MACROTILE_MODE0-15 (0x2644-0x2673).
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=111273
Signed-off-by: Trek <trek00@inbox.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c index e42fe034aacd..4257c1a9099f 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c @@ -683,6 +683,9 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) sh_num = 0xffffffff; + if (info->read_mmr_reg.count > 128) + return -EINVAL; + regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL); if (!regs) return -ENOMEM; |