[PATCH] drm/amdgpu: check the result of copy_from_user in secure display debugfs

[PATCH] drm/amdgpu: check the result of copy_from_user in secure display debugfs

[Alex Deucher]

Make sure the copy succeeded.  Also fixes a warning.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c
index 455978781380..1f98ce4e56f2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c
@@ -101,7 +101,9 @@ static ssize_t amdgpu_securedisplay_debugfs_write(struct file *f, const char __u
 		return -EINVAL;
 
 	memset(str,  0, sizeof(str));
-	copy_from_user(str, buf, size);
+	ret = copy_from_user(str, buf, size);
+	if (ret >= size)
+		return -EINVAL;
 
 	ret = pm_runtime_get_sync(dev->dev);
 	if (ret < 0) {
-- 
2.29.2

_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

Re: [PATCH] drm/amdgpu: check the result of copy_from_user in secure display debugfs

[Christian König]

Am 04.01.21 um 18:43 schrieb Alex Deucher:
> Make sure the copy succeeded.  Also fixes a warning.
>
> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c
> index 455978781380..1f98ce4e56f2 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c
> @@ -101,7 +101,9 @@ static ssize_t amdgpu_securedisplay_debugfs_write(struct file *f, const char __u
>   		return -EINVAL;
>   
>   	memset(str,  0, sizeof(str));
> -	copy_from_user(str, buf, size);
> +	ret = copy_from_user(str, buf, size);
> +	if (ret >= size)
> +		return -EINVAL;

IIRC copy_from_user return the number of bytes which couldn't be copied.

E.g. theta should be if (ret) return -EFAULT.

Christian.

>   
>   	ret = pm_runtime_get_sync(dev->dev);
>   	if (ret < 0) {

_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx