From c71dbd93eb0039838de920ae1712ff65fd648290 Mon Sep 17 00:00:00 2001 From: Tom St Denis Date: Mon, 2 May 2016 08:35:35 -0400 Subject: [PATCH] drm/amd/amdgpu: ring debugfs is read in increments of 4 bytes MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit If a user tries to read a non-multiple of 4 bytes it would have read until the end of the ring potentially crashing the user task. Signed-off-by: Tom St Denis Reviewed-by: Christian König Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c index 5491696ac827..942111517e40 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c @@ -383,7 +383,7 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf, int r, i; uint32_t value, result, early[3]; - if (*pos & 3) + if (*pos & 3 || size & 3) return -EINVAL; result = 0; -- 2.34.1