summary refs log tree commit diff
path: root/drivers/gpu
diff options
context:
space:
mode:
authorHarry Wentland <harry.wentland@amd.com>2021-10-27 10:26:33 -0400
committerAlex Deucher <alexander.deucher@amd.com>2021-11-05 14:10:39 -0400
commit25a1a08fe79be6ef00e1393b1f5545f6ba62919f (patch)
tree3094f8a13eeed0734a1fdba19d6f51480c85f695 /drivers/gpu
parent78469728809b8604dc37ae4e6b12ae12decac5be (diff)
downloadlinux-25a1a08fe79be6ef00e1393b1f5545f6ba62919f.tar.gz
drm/amd/display: Don't allow partial copy_from_user
There is no reason to allow for partial buffers from userspace in our
debugfs. In this particular case callers will zero out the wr_buf but if
callers in the future don't do that we might be looking at corrupt data.

Linus puts it better than I can in
https://lkml.org/lkml/2021/10/26/993

Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu')
-rw-r--r--drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c10
1 files changed, 4 insertions, 6 deletions
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 3655663e079b..9d43ecb1f692 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -78,12 +78,10 @@ static int parse_write_buffer_into_params(char *wr_buf, uint32_t wr_buf_size,
 
 	wr_buf_ptr = wr_buf;
 
-	r = copy_from_user(wr_buf_ptr, buf, wr_buf_size);
-
-		/* r is bytes not be copied */
-	if (r >= wr_buf_size) {
-		DRM_DEBUG_DRIVER("user data not be read\n");
-		return -EINVAL;
+	/* r is bytes not be copied */
+	if (copy_from_user(wr_buf_ptr, buf, wr_buf_size)) {
+		DRM_DEBUG_DRIVER("user data could not be read successfully\n");
+		return -EFAULT;
 	}
 
 	/* check number of parameters. isspace could not differ space and \n */