Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cc376abf authored by Trek's avatar Trek Committed by Greg Kroah-Hartman
Browse files

drm/amdgpu: Check for valid number of registers to read 

[ Upstream commit 73d8e6c7b841d9bf298c8928f228fb433676635c ]

Do not try to allocate any amount of memory requested by the user.
Instead limit it to 128 registers. Actually the longest series of
consecutive allowed registers are 48, mmGB_TILE_MODE0-31 and
mmGB_MACROTILE_MODE0-15 (0x2644-0x2673).

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=111273


Signed-off-by: default avatarTrek <trek00@inbox.ru>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 7059ce31

drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c

+3 −0
Original line number Diff line number Diff line
@@ -540,6 +540,9 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file 
		if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK)

			sh_num = 0xffffffff;



		if (info->read_mmr_reg.count > 128)

			return -EINVAL;



		regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL);

		if (!regs)

			return -ENOMEM;