Re: [PATCH 1/3] drm/amd/display: Don't allow partial copy_from_user

[Rodrigo Siqueira Jordao <rjordrigo@amd.com>]

Hi Harry,

lgtm.
Btw, it looks like that the other patches from this series are already 
applied to amd-staging-drm-next.

Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>


On 2021-10-27 10:26 a.m., Harry Wentland wrote:
> There is no reason to allow for partial buffers from
> userspace in our debugfs. In this particular case
> callers will zero out the wr_buf but if callers in
> the future don't do that we might be looking at
> corrupt data.
> 
> Linus puts it better than I can in
> https://lkml.org/lkml/2021/10/26/993
> 
> Signed-off-by: Harry Wentland <harry.wentland@amd.com>
> ---
>   .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c  | 10 ++++------
>   1 file changed, 4 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> index 1a68a674913c..b30307ccff12 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> @@ -78,12 +78,10 @@ static int parse_write_buffer_into_params(char *wr_buf, uint32_t wr_buf_size,
>   
>   	wr_buf_ptr = wr_buf;
>   
> -	r = copy_from_user(wr_buf_ptr, buf, wr_buf_size);
> -
> -		/* r is bytes not be copied */
> -	if (r >= wr_buf_size) {
> -		DRM_DEBUG_DRIVER("user data not be read\n");
> -		return -EINVAL;
> +	/* r is bytes not be copied */
> +	if (copy_from_user(wr_buf_ptr, buf, wr_buf_size)) {
> +		DRM_DEBUG_DRIVER("user data could not be read successfully\n");
> +		return -EFAULT;
>   	}
>   
>   	/* check number of parameters. isspace could not differ space and \n */
>