lkml.org 
[lkml]   [2019]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] drm/amdgpu: fix double fetch in amdgpu_ras_debugfs_ctrl_parse_data()
In amdgpu_ras_debugfs_ctrl_parse_data(), first fetch str from buf to
get op value, if op == -1 which means no command matched, fetch data
from buf again.

If change buf between two fetches may cause security problems or
unexpected behaivor. amdgpu_ras_debugfs_ctrl_parse_data() was called
by amdgpu_ras_debugfs_ctrl_write() and value of op was used later.

We should check whether data->op == -1 or not after second fetch. if
data->op != -1 means buf changed and should return -EINVAL.

Signed-off-by: JingYi Hou <houjingyi647@gmail.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 22bd21efe6b1..845e73e98cd7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -233,6 +233,9 @@ static int amdgpu_ras_debugfs_ctrl_parse_data(struct file *f,

if (copy_from_user(data, buf, sizeof(*data)))
return -EINVAL;
+
+ if(data->op != -1)
+ return -EINVAL;
}

return 0;
--
2.20.1
\
 
 \ /
  Last update: 2019-07-16 13:12    [W:0.034 / U:61.752 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site