diff options
| author | YiPeng Chai <YiPeng.Chai@amd.com> | 2026-05-19 13:46:55 +0800 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2026-05-19 11:53:14 -0400 |
| commit | 2206e6c76d05e30447330d00c324fa03e35e4f0c (patch) | |
| tree | 8fd7c4c52ed1c1959cee1696329b33cbe1a13e9a /drivers/gpu/drm/amd/ras/ras_mgr | |
| parent | 642ed3af44dbe2c1258bfbcda8c294bc3cfd1d39 (diff) | |
drm/amd/ras: add length check for ras command output buffer
Add length check for ras command output buffer.
Signed-off-by: YiPeng Chai <YiPeng.Chai@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Diffstat (limited to 'drivers/gpu/drm/amd/ras/ras_mgr')
| -rw-r--r-- | drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_ras_cmd.c | 8 | ||||
| -rw-r--r-- | drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c | 5 |
2 files changed, 8 insertions, 5 deletions
diff --git a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_ras_cmd.c b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_ras_cmd.c index cb6498c30834..c22e53e84207 100644 --- a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_ras_cmd.c +++ b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_ras_cmd.c @@ -139,7 +139,8 @@ static int amdgpu_ras_get_ras_safe_fb_addr_ranges(struct ras_core_context *ras_c struct amdgpu_mem_partition_info *mem_ranges; uint32_t i = 0; - if (cmd->input_size != sizeof(*input_data)) + if ((cmd->input_size != sizeof(*input_data)) || + (cmd->output_buf_size < sizeof(*ranges))) return RAS_CMD__ERROR_INVALID_INPUT_DATA; mem_ranges = adev->gmc.mem_partitions; @@ -207,7 +208,8 @@ static int amdgpu_ras_translate_fb_address(struct ras_core_context *ras_core, (struct ras_cmd_translate_fb_address_rsp *)cmd->output_buff_raw; int ret = RAS_CMD__ERROR_GENERIC; - if (cmd->input_size != sizeof(struct ras_cmd_translate_fb_address_req)) + if ((cmd->input_size != sizeof(struct ras_cmd_translate_fb_address_req)) || + (cmd->output_buf_size < sizeof(*rsp_buff))) return RAS_CMD__ERROR_INVALID_INPUT_SIZE; if ((req_buff->src_addr_type >= RAS_FB_ADDR_UNKNOWN) || @@ -279,7 +281,7 @@ int amdgpu_ras_submit_cmd(struct ras_core_context *ras_core, struct ras_cmd_ctx cmd->cmd_res = res; - if (cmd->output_size > cmd->output_buf_size) { + if (!res && (cmd->output_size > cmd->output_buf_size)) { RAS_DEV_ERR(cmd_core->dev, "Output size 0x%x exceeds output buffer size 0x%x!\n", cmd->output_size, cmd->output_buf_size); diff --git a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c index daad99a46263..6ef9ec7ed597 100644 --- a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c +++ b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c @@ -261,7 +261,8 @@ static int amdgpu_virt_ras_get_cper_records(struct ras_core_context *ras_core, uint8_t *out_buf; int ret = 0, i, count; - if (cmd->input_size != sizeof(struct ras_cmd_cper_record_req)) + if (cmd->input_size != sizeof(struct ras_cmd_cper_record_req) || + (cmd->output_buf_size < sizeof(*rsp))) return RAS_CMD__ERROR_INVALID_INPUT_SIZE; if (!req->buf_size || !req->buf_ptr || !req->cper_num || @@ -471,7 +472,7 @@ int amdgpu_virt_ras_handle_cmd(struct ras_core_context *ras_core, cmd->cmd_res = res; - if (cmd->output_size > cmd->output_buf_size) { + if (!res && (cmd->output_size > cmd->output_buf_size)) { RAS_DEV_ERR(ras_core->dev, "Output data size 0x%x exceeds buffer size 0x%x!\n", cmd->output_size, cmd->output_buf_size); |