DragonFlyBSD Kernel Audit
DF-1692 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c b/sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c
--- a/sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -716,20 +716,29 @@
 	amdgpu_gfx_select_se_sh(adev, se, sh, cu);
 
 	if (bank == 0) {
-		if (adev->gfx.funcs->read_wave_vgprs)
-			adev->gfx.funcs->read_wave_vgprs(adev, simd, wave, thread, offset, size>>2, data);
+		if (adev->gfx.funcs->read_wave_vgprs) {
+			size_t dword_count = size >> 2;
+			if (dword_count > 1024)
+				dword_count = 1024;
+			adev->gfx.funcs->read_wave_vgprs(adev, simd, wave, thread, offset, dword_count, data);
+		}
 	} else {
-		if (adev->gfx.funcs->read_wave_sgprs)
-			adev->gfx.funcs->read_wave_sgprs(adev, simd, wave, offset, size>>2, data);
+		if (adev->gfx.funcs->read_wave_sgprs) {
+			size_t dword_count = size >> 2;
+			if (dword_count > 1024)
+				dword_count = 1024;
+			adev->gfx.funcs->read_wave_sgprs(adev, simd, wave, offset, dword_count, data);
+		}
 	}
 
 	amdgpu_gfx_select_se_sh(adev, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF);
 	mutex_unlock(&adev->grbm_idx_mutex);
 
-	while (size) {
+	while (size && offset < 4096) {
 		uint32_t value;
 
-		value = data[offset++];
+		value = data[offset >> 2];
+		offset += 4;
 		r = put_user(value, (uint32_t *)buf);
 		if (r) {
 			result = r;