]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
drm/amdgpu: Fix buffer overflow in INFO ioctl
authorAlex Deucher <alexander.deucher@amd.com>
Tue, 25 Aug 2020 15:43:45 +0000 (11:43 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 3 Sep 2020 09:22:32 +0000 (11:22 +0200)
commit5430e7638ef41a4aa25e274577a0bb042f933a70
tree21b85f25dd00b935b09349d9351a1b7df8edcbe2
parentfb545b9fc756332f4430307ccf7b58e4f3d5f64f
drm/amdgpu: Fix buffer overflow in INFO ioctl

commit b5b97cab55eb71daba3283c8b1d2cce456d511a1 upstream.

The values for "se_num" and "sh_num" come from the user in the ioctl.
They can be in the 0-255 range but if they're more than
AMDGPU_GFX_MAX_SE (4) or AMDGPU_GFX_MAX_SH_PER_SE (2) then it results in
an out of bounds read.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c