Commit 7861c7a4 authored by Dan Carpenter's avatar Dan Carpenter Committed by Oded Gabbay

drm/amdkfd: fix some range checks in address watch ioctl

buf_size_in_bytes must be large enough to hold ->num_watch_points and
watch_mode so I have added a sizeof(int) * 2 to the minimum size.

Also we have to subtract sizeof(*args) from the max args_idx limit so
that it matches the allocation.  Also I changed a > to >= for the last
compare.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarOded Gabbay <oded.gabbay@gmail.com>
parent 6876f98b
...@@ -553,7 +553,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep, ...@@ -553,7 +553,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
/* Validate arguments */ /* Validate arguments */
if ((args->buf_size_in_bytes > MAX_ALLOWED_AW_BUFF_SIZE) || if ((args->buf_size_in_bytes > MAX_ALLOWED_AW_BUFF_SIZE) ||
(args->buf_size_in_bytes <= sizeof(*args)) || (args->buf_size_in_bytes <= sizeof(*args) + sizeof(int) * 2) ||
(cmd_from_user == NULL)) (cmd_from_user == NULL))
return -EINVAL; return -EINVAL;
...@@ -590,7 +590,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep, ...@@ -590,7 +590,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
/* skip over the addresses buffer */ /* skip over the addresses buffer */
args_idx += sizeof(aw_info.watch_address) * aw_info.num_watch_points; args_idx += sizeof(aw_info.watch_address) * aw_info.num_watch_points;
if (args_idx >= args->buf_size_in_bytes) { if (args_idx >= args->buf_size_in_bytes - sizeof(*args)) {
kfree(args_buff); kfree(args_buff);
return -EINVAL; return -EINVAL;
} }
...@@ -614,7 +614,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep, ...@@ -614,7 +614,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
args_idx += sizeof(aw_info.watch_mask); args_idx += sizeof(aw_info.watch_mask);
} }
if (args_idx > args->buf_size_in_bytes) { if (args_idx >= args->buf_size_in_bytes - sizeof(args)) {
kfree(args_buff); kfree(args_buff);
return -EINVAL; return -EINVAL;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment