[patch] drm/amdkfd: fix some range checks in address watch ioctl

[Oded Gabbay]

On Thu, Jun 11, 2015 at 6:19 PM, Dan Carpenter <dan.carpenter at oracle.com> wrote:
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> index 96c904b..54a608a 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
> @@ -553,7 +554,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
>         /* Validate arguments */
>
>         if ((args->buf_size_in_bytes > MAX_ALLOWED_AW_BUFF_SIZE) ||
> -               (args->buf_size_in_bytes <= sizeof(*args)) ||
> +               (args->buf_size_in_bytes <= sizeof(*args) + sizeof(int) * 2) ||
>                 (cmd_from_user == NULL))
>                 return -EINVAL;
>
> @@ -590,7 +596,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
>         /* skip over the addresses buffer */
>         args_idx += sizeof(aw_info.watch_address) * aw_info.num_watch_points;
>
> -       if (args_idx >= args->buf_size_in_bytes) {
> +       if (args_idx >= args->buf_size_in_bytes - sizeof(*args)) {
>                 kfree(args_buff);
>                 return -EINVAL;
>         }
> @@ -614,7 +620,7 @@ static int kfd_ioctl_dbg_address_watch(struct file *filep,
>                 args_idx += sizeof(aw_info.watch_mask);
>         }
>
> -       if (args_idx > args->buf_size_in_bytes) {
> +       if (args_idx >= args->buf_size_in_bytes - sizeof(args)) {
>                 kfree(args_buff);
>                 return -EINVAL;
>         }

Hi Dan,

I took the above section and made a patch from them which I then
applied to my -next-fixes tree (to be included in 4.2 merge window).
Thanks!

Yair,
I suggest you take my amdkfd-next-fixes branch and test it with your
debugger tests.

John,
If you could try publishing kfdtest as we talked about, that would be
great because then everyone will be able to check this.

   Oded