From: Harry Wentland Date: Wed, 27 Oct 2021 14:26:33 +0000 (-0400) Subject: drm/amd/display: Don't allow partial copy_from_user X-Git-Tag: v5.16-rc1~38^2~2^2~22 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=25a1a08fe79be6ef00e1393b1f5545f6ba62919f;p=thirdparty%2Flinux.git drm/amd/display: Don't allow partial copy_from_user There is no reason to allow for partial buffers from userspace in our debugfs. In this particular case callers will zero out the wr_buf but if callers in the future don't do that we might be looking at corrupt data. Linus puts it better than I can in https://lkml.org/lkml/2021/10/26/993 Reviewed-by: Rodrigo Siqueira Signed-off-by: Harry Wentland Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index 3655663e079ba..9d43ecb1f692d 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -78,12 +78,10 @@ static int parse_write_buffer_into_params(char *wr_buf, uint32_t wr_buf_size, wr_buf_ptr = wr_buf; - r = copy_from_user(wr_buf_ptr, buf, wr_buf_size); - - /* r is bytes not be copied */ - if (r >= wr_buf_size) { - DRM_DEBUG_DRIVER("user data not be read\n"); - return -EINVAL; + /* r is bytes not be copied */ + if (copy_from_user(wr_buf_ptr, buf, wr_buf_size)) { + DRM_DEBUG_DRIVER("user data could not be read successfully\n"); + return -EFAULT; } /* check number of parameters. isspace could not differ space and \n */