Re: [patch] drm/amdkfd: fix some range checks in address watch ioctl

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jun 11, 2015 at 6:19 PM, Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> index 96c904b..54a608a 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> @@ -553,7 +554,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
>         /* Validate arguments */
>
>         if ((args->buf_size_in_bytes > MAX_ALLOWED_AW_BUFF_SIZE) ||
> -               (args->buf_size_in_bytes <= sizeof(*args)) ||
> +               (args->buf_size_in_bytes <= sizeof(*args) + sizeof(int) * 2) ||
>                 (cmd_from_user == NULL))
>                 return -EINVAL;
>
> @@ -590,7 +596,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
>         /* skip over the addresses buffer */
>         args_idx += sizeof(aw_info.watch_address) * aw_info.num_watch_points;
>
> -       if (args_idx >= args->buf_size_in_bytes) {
> +       if (args_idx >= args->buf_size_in_bytes - sizeof(*args)) {
>                 kfree(args_buff);
>                 return -EINVAL;
>         }
> @@ -614,7 +620,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
>                 args_idx += sizeof(aw_info.watch_mask);
>         }
>
> -       if (args_idx > args->buf_size_in_bytes) {
> +       if (args_idx >= args->buf_size_in_bytes - sizeof(args)) {
>                 kfree(args_buff);
>                 return -EINVAL;
>         }

Hi Dan,

I took the above section and made a patch from them which I then
applied to my -next-fixes tree (to be included in 4.2 merge window).
Thanks!

Yair,
I suggest you take my amdkfd-next-fixes branch and test it with your
debugger tests.

John,
If you could try publishing kfdtest as we talked about, that would be
great because then everyone will be able to check this.

   Oded
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/dri-devel




[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux