Received: by 2002:a5b:505:0:0:0:0:0 with SMTP id o5csp1049781ybp; Thu, 17 Oct 2019 07:21:13 -0700 (PDT) X-Google-Smtp-Source: APXvYqxsm1A5M/hk2hjIIVsDRMcZ7RF3jRDFZgPth/o7je5DLhlAtaAmHndOGc7FJ7c4aX84W+jD X-Received: by 2002:a17:906:7257:: with SMTP id n23mr3837849ejk.132.1571322072696; Thu, 17 Oct 2019 07:21:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1571322072; cv=none; d=google.com; s=arc-20160816; b=b22ruAXQX3Smug8kqOt/W2edAHyxruY77/ek6ITE5VPXkZ4DzNCcx4NWolcg+lln1V ZEOe11M544rFWqTWd+lvjSgcmn+rldLppiJEPr7TYooFocgCcds1+vJAqV/NzaKl1813 IwedtA9RWxRkDrBGgvOprRl4xlThy7oW8hkDFe9NpQrdh1pxcESTk7VKGkOW1ZDzi6lB DR0ZHQMJ7vMusNp79dnP4amHF53jG5wWmfwObHRe8EDoK40wlC9NpHzkslxUJacNlGG2 45S2FWvLN9r6+tLKKSk/HWlvJT+bSNYWcEwh/AX64gLngkxnWv0f6/7S1xw4CPx0XwzS 5zGA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=e7D48vocp7KdLoPijByUsnmALWFuGg6q2jzkwwrDJkA=; b=PPqpmISXK1Vx/erAD2g+Z8ZJN5zDVfYX2F4ZJdm6IuBw4PTLfa7B07XskfjiTh/GHv IMLVmhmSQy8c8/q0lcburae7id35J7J1NlmER8j7IKl8DmMPcVb9efaC8OLqcwMMSMe7 kBzJ5ant5pd/kwn3gGspEOJ/Rj1AwIbtWUuPkQRCE+7U0uZajizMd0SbIjkkLK/qpgXP 2HOG0pCDGd8cWyW+iEnqaz31tGj/vMA1A5mAMEwjo39YarhUIKiy2OJeEDmvQcyuvj1x MvXPz9Reri8OCcctrYOzUdcLf/aJ7+ukiLSCuNmF+NMBFGl3uqM8Gku9CVneeE49IWkd qRyQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=F2d5ps6x; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 53si1743950edz.275.2019.10.17.07.20.49; Thu, 17 Oct 2019 07:21:12 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=F2d5ps6x; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728540AbfJPVyc (ORCPT + 99 others); Wed, 16 Oct 2019 17:54:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:43988 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2394952AbfJPVyP (ORCPT ); Wed, 16 Oct 2019 17:54:15 -0400 Received: from localhost (unknown [192.55.54.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 005EE21925; Wed, 16 Oct 2019 21:54:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1571262855; bh=f6t4c88a69fuHzhV8io9AVBJIcK7SkSDMOV9GaanKkY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F2d5ps6xO5jN95Rr9xsLYnNx7RWcQKJLhxCJFoxms/k3JS08GFVDpeaWLjTGf9m6g PqS5cMOdilzbGfFYn6NtwGWGmXcC0fRSpY/g+dSqm0rorE5eeqOJ23KLK6L+90kdjg DLtkViwZdt0PQ+ZjZNqhe87HGbUNw7L/EE03vyDw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Trek , Alex Deucher , Sasha Levin Subject: [PATCH 4.9 21/92] drm/amdgpu: Check for valid number of registers to read Date: Wed, 16 Oct 2019 14:49:54 -0700 Message-Id: <20191016214818.171084892@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191016214759.600329427@linuxfoundation.org> References: <20191016214759.600329427@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Trek [ Upstream commit 73d8e6c7b841d9bf298c8928f228fb433676635c ] Do not try to allocate any amount of memory requested by the user. Instead limit it to 128 registers. Actually the longest series of consecutive allowed registers are 48, mmGB_TILE_MODE0-31 and mmGB_MACROTILE_MODE0-15 (0x2644-0x2673). Bug: https://bugs.freedesktop.org/show_bug.cgi?id=111273 Signed-off-by: Trek Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin --- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c index 3938fca1ea8e5..24941a7b659f4 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c @@ -430,6 +430,9 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) sh_num = 0xffffffff; + if (info->read_mmr_reg.count > 128) + return -EINVAL; + regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL); if (!regs) return -ENOMEM; -- 2.20.1