Commit 9de9a54a authored by Shirish S's avatar Shirish S Committed by Alex Deucher

drm/amd/display: fix crash/reboot while accessing sysfs files

read/writes to aux_dpcd_* sysfs entries leads to system
reboot or hang.
Hence fix the handling of input data and reporting of errors
appropriately to the user space.
Signed-off-by: default avatarShirish S <shirish.s@amd.com>
Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 59d7115d
...@@ -908,7 +908,7 @@ static ssize_t dp_dpcd_address_write(struct file *f, const char __user *buf, ...@@ -908,7 +908,7 @@ static ssize_t dp_dpcd_address_write(struct file *f, const char __user *buf,
struct amdgpu_dm_connector *connector = file_inode(f)->i_private; struct amdgpu_dm_connector *connector = file_inode(f)->i_private;
if (size < sizeof(connector->debugfs_dpcd_address)) if (size < sizeof(connector->debugfs_dpcd_address))
return 0; return -EINVAL;
r = copy_from_user(&connector->debugfs_dpcd_address, r = copy_from_user(&connector->debugfs_dpcd_address,
buf, sizeof(connector->debugfs_dpcd_address)); buf, sizeof(connector->debugfs_dpcd_address));
...@@ -923,7 +923,7 @@ static ssize_t dp_dpcd_size_write(struct file *f, const char __user *buf, ...@@ -923,7 +923,7 @@ static ssize_t dp_dpcd_size_write(struct file *f, const char __user *buf,
struct amdgpu_dm_connector *connector = file_inode(f)->i_private; struct amdgpu_dm_connector *connector = file_inode(f)->i_private;
if (size < sizeof(connector->debugfs_dpcd_size)) if (size < sizeof(connector->debugfs_dpcd_size))
return 0; return -EINVAL;
r = copy_from_user(&connector->debugfs_dpcd_size, r = copy_from_user(&connector->debugfs_dpcd_size,
buf, sizeof(connector->debugfs_dpcd_size)); buf, sizeof(connector->debugfs_dpcd_size));
...@@ -943,8 +943,8 @@ static ssize_t dp_dpcd_data_write(struct file *f, const char __user *buf, ...@@ -943,8 +943,8 @@ static ssize_t dp_dpcd_data_write(struct file *f, const char __user *buf,
struct dc_link *link = connector->dc_link; struct dc_link *link = connector->dc_link;
uint32_t write_size = connector->debugfs_dpcd_size; uint32_t write_size = connector->debugfs_dpcd_size;
if (size < write_size) if (!write_size || size < write_size)
return 0; return -EINVAL;
data = kzalloc(write_size, GFP_KERNEL); data = kzalloc(write_size, GFP_KERNEL);
if (!data) if (!data)
...@@ -967,7 +967,7 @@ static ssize_t dp_dpcd_data_read(struct file *f, char __user *buf, ...@@ -967,7 +967,7 @@ static ssize_t dp_dpcd_data_read(struct file *f, char __user *buf,
struct dc_link *link = connector->dc_link; struct dc_link *link = connector->dc_link;
uint32_t read_size = connector->debugfs_dpcd_size; uint32_t read_size = connector->debugfs_dpcd_size;
if (size < read_size) if (!read_size || size < read_size)
return 0; return 0;
data = kzalloc(read_size, GFP_KERNEL); data = kzalloc(read_size, GFP_KERNEL);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment