drm/amd/amdgpu: ring debugfs is read in increments of 4 bytes

If a user tries to read a non-multiple of 4 bytes it would have
read until the end of the ring potentially crashing the user
task.

Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
index 5491696ac8270c98d552129d0d670baa6f57d58d..942111517e409d29916841a651c704c3bfcf63e2 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c
@@ -383,7 +383,7 @@ static ssize_t amdgpu_debugfs_ring_read(struct file *f, char __user *buf,
        int r, i;
        uint32_t value, result, early[3];
 
-       if (*pos & 3)
+       if (*pos & 3 || size & 3)
                return -EINVAL;
 
        result = 0;