github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/amdgpu: NUL-terminate securedisplay debugfs input from userspace

Browse Source 
Use strncpy_from_user() instead of copy_from_user() before sscanf() in
the securedisplay_test debugfs write handler so a full-length write
cannot leave the stack buffer without a terminator.

Signed-off-by: Candice Li <candice.li@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Candice Li 2026-05-19 18:42:09 +08:00 committed by Alex Deucher
parent c83e4a45ff
commit 66a856e3e5
1 changed files with 22 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c
View File

@ -98,15 +98,18 @@ static ssize_t amdgpu_securedisplay_debugfs_write(struct file *f, const char __u
uint32_t phy_id;
uint32_t op;
char str[64];
int ret;
long len;
ssize_t write_ret = size;
int ret, nargs;
if (*pos || size > sizeof(str) - 1)
if (*pos)
return -EINVAL;
memset(str, 0, sizeof(str));
ret = copy_from_user(str, buf, size);
if (ret)
len = strncpy_from_user(str, buf, sizeof(str));
if (len < 0)
return -EFAULT;
if (len == 0 || len >= sizeof(str))
return -EINVAL;
ret = pm_runtime_get_sync(dev->dev);
if (ret < 0) {
@ -114,10 +117,14 @@ static ssize_t amdgpu_securedisplay_debugfs_write(struct file *f, const char __u
return ret;
}
if (size < 3)
sscanf(str, "%u ", &op);
if (len < 3)
nargs = sscanf(str, "%u", &op);
else
sscanf(str, "%u %u", &op, &phy_id);
nargs = sscanf(str, "%u %u", &op, &phy_id);
if (nargs < 1) {
write_ret = -EINVAL;
goto out;
}
switch (op) {
case 1:
@ -135,9 +142,10 @@ static ssize_t amdgpu_securedisplay_debugfs_write(struct file *f, const char __u
mutex_unlock(&psp->securedisplay_context.mutex);
break;
case 2:
if (size < 3 || phy_id >= TA_SECUREDISPLAY_MAX_PHY) {
if (nargs < 2 || phy_id >= TA_SECUREDISPLAY_MAX_PHY) {
dev_err(adev->dev, "Invalid input: %s\n", str);
return -EINVAL;
write_ret = -EINVAL;
break;
}
mutex_lock(&psp->securedisplay_context.mutex);
psp_prep_securedisplay_cmd_buf(psp, &securedisplay_cmd,
@ -157,11 +165,14 @@ static ssize_t amdgpu_securedisplay_debugfs_write(struct file *f, const char __u
break;
default:
dev_err(adev->dev, "Invalid input: %s\n", str);
write_ret = -EINVAL;
break;
}
out:
pm_runtime_put_autosuspend(dev->dev);
return size;
return write_ret;
}
static const struct file_operations amdgpu_securedisplay_debugfs_ops = {