On Wed, Mar 11, 2020 at 4:33 PM Tom St Denis <tom.stdenis@xxxxxxx> wrote:
>
> The offset into the array was specified in bytes but should
> be in terms of 32-bit words. Also prevent large reads that
> would also cause a buffer overread.
>
> v2: Read from correct offset from internal storage buffer.
>
> Signed-off-by: Tom St Denis <tom.stdenis@xxxxxxx>
> Acked-by: Christian König <christian.koenig@xxxxxxx>
Reviewed-by: Alex Deucher <alexander.deucher@xxxxxxx>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> index 00942afc4e13..02bb1be11ffe 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> @@ -784,11 +784,11 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
> ssize_t result = 0;
> uint32_t offset, se, sh, cu, wave, simd, thread, bank, *data;
>
> - if (size & 3 || *pos & 3)
> + if (size > 4096 || size & 3 || *pos & 3)
> return -EINVAL;
>
> /* decode offset */
> - offset = *pos & GENMASK_ULL(11, 0);
> + offset = (*pos & GENMASK_ULL(11, 0)) >> 2;
> se = (*pos & GENMASK_ULL(19, 12)) >> 12;
> sh = (*pos & GENMASK_ULL(27, 20)) >> 20;
> cu = (*pos & GENMASK_ULL(35, 28)) >> 28;
> @@ -826,7 +826,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
> while (size) {
> uint32_t value;
>
> - value = data[offset++];
> + value = data[result >> 2];
> r = put_user(value, (uint32_t *)buf);
> if (r) {
> result = r;
> --
> 2.24.1
>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx@xxxxxxxxxxxxxxxxxxxxx
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx
_______________________________________________
amd-gfx mailing list
amd-gfx@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/amd-gfx
