[PATCH] drm/amd/amdgpu: Fix GPR read from debugfs

[Christian König]

Am 10.03.20 um 13:53 schrieb Tom St Denis:
> The offset into the array was specified in bytes but should
> be in terms of 32-bit words.  Also prevent large reads that
> would also cause a buffer overread.
>
> Signed-off-by: Tom St Denis <tom.stdenis at amd.com>

Acked-by: Christian König <christian.koenig at amd.com>

> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> index c573edf02afc..e0f4ccd91fd4 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
> @@ -783,11 +783,11 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
>   	ssize_t result = 0;
>   	uint32_t offset, se, sh, cu, wave, simd, thread, bank, *data;
>   
> -	if (size & 3 || *pos & 3)
> +	if (size > 4096 || size & 3 || *pos & 3)
>   		return -EINVAL;
>   
>   	/* decode offset */
> -	offset = *pos & GENMASK_ULL(11, 0);
> +	offset = (*pos & GENMASK_ULL(11, 0)) / 4;
>   	se = (*pos & GENMASK_ULL(19, 12)) >> 12;
>   	sh = (*pos & GENMASK_ULL(27, 20)) >> 20;
>   	cu = (*pos & GENMASK_ULL(35, 28)) >> 28;