4.14-stable patches

added patches:
	drm-amdgpu-prevent-kernel-infoleak-in-amdgpu_info_ioctl.patch
	drm-hold-gem-reference-until-object-is-no-longer-accessed.patch

diff --git a/queue-4.14/drm-amdgpu-prevent-kernel-infoleak-in-amdgpu_info_ioctl.patch b/queue-4.14/drm-amdgpu-prevent-kernel-infoleak-in-amdgpu_info_ioctl.patch
new file mode 100644 (file)
index 0000000..feeed3b
--- /dev/null
+++ b/queue-4.14/drm-amdgpu-prevent-kernel-infoleak-in-amdgpu_info_ioctl.patch
@@ -0,0 +1,46 @@
+From 543e8669ed9bfb30545fd52bc0e047ca4df7fb31 Mon Sep 17 00:00:00 2001
+From: Peilin Ye <yepeilin.cs@gmail.com>
+Date: Tue, 28 Jul 2020 15:29:24 -0400
+Subject: drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peilin Ye <yepeilin.cs@gmail.com>
+
+commit 543e8669ed9bfb30545fd52bc0e047ca4df7fb31 upstream.
+
+Compiler leaves a 4-byte hole near the end of `dev_info`, causing
+amdgpu_info_ioctl() to copy uninitialized kernel stack memory to userspace
+when `size` is greater than 356.
+
+In 2015 we tried to fix this issue by doing `= {};` on `dev_info`, which
+unfortunately does not initialize that 4-byte hole. Fix it by using
+memset() instead.
+
+Cc: stable@vger.kernel.org
+Fixes: c193fa91b918 ("drm/amdgpu: information leak in amdgpu_info_ioctl()")
+Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
+Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -527,8 +527,9 @@ static int amdgpu_info_ioctl(struct drm_
+               return n ? -EFAULT : 0;
+       }
+       case AMDGPU_INFO_DEV_INFO: {
+-              struct drm_amdgpu_info_device dev_info = {};
++              struct drm_amdgpu_info_device dev_info;
+ 
++              memset(&dev_info, 0, sizeof(dev_info));
+               dev_info.device_id = dev->pdev->device;
+               dev_info.chip_rev = adev->rev_id;
+               dev_info.external_rev = adev->external_rev_id;

diff --git a/queue-4.14/drm-hold-gem-reference-until-object-is-no-longer-accessed.patch b/queue-4.14/drm-hold-gem-reference-until-object-is-no-longer-accessed.patch
new file mode 100644 (file)
index 0000000..9262933
--- /dev/null
+++ b/queue-4.14/drm-hold-gem-reference-until-object-is-no-longer-accessed.patch
@@ -0,0 +1,57 @@
+From 8490d6a7e0a0a6fab5c2d82d57a3937306660864 Mon Sep 17 00:00:00 2001
+From: Steve Cohen <cohens@codeaurora.org>
+Date: Mon, 20 Jul 2020 18:30:50 -0400
+Subject: drm: hold gem reference until object is no longer accessed
+
+From: Steve Cohen <cohens@codeaurora.org>
+
+commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864 upstream.
+
+A use-after-free in drm_gem_open_ioctl can happen if the
+GEM object handle is closed between the idr lookup and
+retrieving the size from said object since a local reference
+is not being held at that point. Hold the local reference
+while the object can still be accessed to fix this and
+plug the potential security hole.
+
+Signed-off-by: Steve Cohen <cohens@codeaurora.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_gem.c |   10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -730,9 +730,6 @@ err:
+  * @file_priv: drm file-private structure
+  *
+  * Open an object using the global name, returning a handle and the size.
+- *
+- * This handle (of course) holds a reference to the object, so the object
+- * will not go away until the handle is deleted.
+  */
+ int
+ drm_gem_open_ioctl(struct drm_device *dev, void *data,
+@@ -757,14 +754,15 @@ drm_gem_open_ioctl(struct drm_device *de
+ 
+       /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
+       ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
+-      drm_gem_object_put_unlocked(obj);
+       if (ret)
+-              return ret;
++              goto err;
+ 
+       args->handle = handle;
+       args->size = obj->size;
+ 
+-      return 0;
++err:
++      drm_gem_object_put_unlocked(obj);
++      return ret;
+ }
+ 
+ /**

diff --git a/queue-4.14/series b/queue-4.14/series
index 7ad8ec31d2935646030527c05e10b5c2b6248f86..0b31ac950003560e827c43ed15a3fb056a3a65aa 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -11,3 +11,5 @@ wireless-use-offsetof-instead-of-custom-macro.patch
 arm-8986-1-hw_breakpoint-don-t-invoke-overflow-handler-on-uaccess-watchpoints.patch
 random32-update-the-net-random-state-on-interrupt-and-activity.patch
 arm-percpu.h-fix-build-error.patch
+drm-amdgpu-prevent-kernel-infoleak-in-amdgpu_info_ioctl.patch
+drm-hold-gem-reference-until-object-is-no-longer-accessed.patch