diff options
| author | Jonathan Gray <jsg@cvs.openbsd.org> | 2020-09-04 01:33:07 +0000 |
|---|---|---|
| committer | Jonathan Gray <jsg@cvs.openbsd.org> | 2020-09-04 01:33:07 +0000 |
| commit | c43e277327c8af86d0a039faec7218517907400f (patch) | |
| tree | ab8c4aabeb45cdd797b978252ad5b80535317232 /sys/dev/pci/drm/amd/amdgpu | |
| parent | 64777f831309aac2f50f8e70eefd101d62593da1 (diff) | |
drm/amdgpu: Fix buffer overflow in INFO ioctl
From Alex Deucher
b5b97cab55eb71daba3283c8b1d2cce456d511a1 in mainline linux
Diffstat (limited to 'sys/dev/pci/drm/amd/amdgpu')
| -rw-r--r-- | sys/dev/pci/drm/amd/amdgpu/amdgpu_kms.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_kms.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_kms.c index 8768908bd55..f706d5e8409 100644 --- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_kms.c +++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_kms.c @@ -718,8 +718,12 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file * in the bitfields */ if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK) se_num = 0xffffffff; + else if (se_num >= AMDGPU_GFX_MAX_SE) + return -EINVAL; if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) sh_num = 0xffffffff; + else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE) + return -EINVAL; if (info->read_mmr_reg.count > 128) return -EINVAL; |