diff options
| author | Christian König <christian.koenig@amd.com> | 2016-09-09 11:21:43 +0200 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2016-09-14 15:10:43 -0400 |
| commit | aa29040b437be9e4255062aa38bcbe7cb50da8c1 (patch) | |
| tree | e3e9c09aef76de44e3bd55c59275dbcb47b7bdd0 | |
| parent | 7c732ea64993b9f37daff9bd95b552576304b6d9 (diff) | |
drm/amdgpu: validate size and offset of user fence BO
We need to validate the offset to make sure that we don't write after the BO.
Additional to that a page should be enough and can make address space
handling much easier.
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index 9480be45b45f..b8412bcbad2a 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -91,6 +91,7 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p, uint32_t *offset) { struct drm_gem_object *gobj; + unsigned long size; gobj = drm_gem_object_lookup(p->filp, data->handle); if (gobj == NULL) @@ -101,6 +102,11 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p, p->uf_entry.tv.bo = &p->uf_entry.robj->tbo; p->uf_entry.tv.shared = true; p->uf_entry.user_pages = NULL; + + size = amdgpu_bo_size(p->uf_entry.robj); + if (size != PAGE_SIZE || (data->offset + 8) > size) + return -EINVAL; + *offset = data->offset; drm_gem_object_unreference_unlocked(gobj); |