drm/amd/pm: Handle non-terminated overdrive commands.

commit 08e9ebc75b5bcfec9d226f9e16bab2ab7b25a39a upstream.

The incoming strings might not be terminated by a newline
or a 0.

(found while testing a program that just wrote the string
 itself, causing a crash)

Cc: stable@vger.kernel.org
Fixes: e3933f26b657 ("drm/amd/pp: Add edit/commit/show OD clock/voltage support in sysfs")
Signed-off-by: Bas Nieuwenhuizen <bas@basnieuwenhuizen.nl>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
index 73794c1c120821698ad6403874c1be9b4913b1ee..23f3cd9f2e8b0dedc4c8f270e9d9ffd10d3d6e20 100644 (file)
--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
@@ -807,7 +807,7 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
        if (adev->in_suspend && !adev->in_runpm)
                return -EPERM;
 
-       if (count > 127)
+       if (count > 127 || count == 0)
                return -EINVAL;
 
        if (*buf == 's')
@@ -827,7 +827,8 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
        else
                return -EINVAL;
 
-       memcpy(buf_cpy, buf, count+1);
+       memcpy(buf_cpy, buf, count);
+       buf_cpy[count] = 0;
 
        tmp_str = buf_cpy;
 
@@ -844,6 +845,9 @@ static ssize_t amdgpu_set_pp_od_clk_voltage(struct device *dev,
                        return -EINVAL;
                parameter_size++;
 
+               if (!tmp_str)
+                       break;
+
                while (isspace(*tmp_str))
                        tmp_str++;
        }