Commit d32c72a2 authored by Tom St Denis's avatar Tom St Denis Committed by Greg Kroah-Hartman

drm/amd/amdgpu: Fix GPR read from debugfs (v2)

commit 5bbc6604 upstream.

The offset into the array was specified in bytes but should
be in terms of 32-bit words.  Also prevent large reads that
would also cause a buffer overread.

v2:  Read from correct offset from internal storage buffer.
Signed-off-by: default avatarTom St Denis <[email protected]>
Acked-by: default avatarChristian König <[email protected]>
Reviewed-by: default avatarAlex Deucher <[email protected]>
Signed-off-by: default avatarAlex Deucher <[email protected]>
Cc: [email protected]
Signed-off-by: default avatarGreg Kroah-Hartman <[email protected]>
parent 409186c5
......@@ -694,11 +694,11 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
ssize_t result = 0;
uint32_t offset, se, sh, cu, wave, simd, thread, bank, *data;
if (size & 3 || *pos & 3)
if (size > 4096 || size & 3 || *pos & 3)
return -EINVAL;
/* decode offset */
offset = *pos & GENMASK_ULL(11, 0);
offset = (*pos & GENMASK_ULL(11, 0)) >> 2;
se = (*pos & GENMASK_ULL(19, 12)) >> 12;
sh = (*pos & GENMASK_ULL(27, 20)) >> 20;
cu = (*pos & GENMASK_ULL(35, 28)) >> 28;
......@@ -729,7 +729,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
while (size) {
uint32_t value;
value = data[offset++];
value = data[result >> 2];
r = put_user(value, (uint32_t *)buf);
if (r) {
result = r;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment