From: Greg Kroah-Hartman Date: Tue, 25 Mar 2025 11:51:31 +0000 (-0400) Subject: 5.10-stable patches X-Git-Tag: v6.1.132~10 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6675ec4763436c98e0eb94c33a14c8c2cb2e119f;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch --- diff --git a/queue-5.10/drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch b/queue-5.10/drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch new file mode 100644 index 0000000000..9d170c4fde --- /dev/null +++ b/queue-5.10/drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch @@ -0,0 +1,105 @@ +From 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 Mon Sep 17 00:00:00 2001 +From: Patrik Jakobsson +Date: Wed, 27 Oct 2021 16:27:30 +0200 +Subject: drm/amdgpu: Fix even more out of bound writes from debugfs + +From: Patrik Jakobsson + +commit 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 upstream. + +CVE-2021-42327 was fixed by: + +commit f23750b5b3d98653b31d4469592935ef6364ad67 +Author: Thelford Williams +Date: Wed Oct 13 16:04:13 2021 -0400 + + drm/amdgpu: fix out of bounds write + +but amdgpu_dm_debugfs.c contains more of the same issue so fix the +remaining ones. + +v2: + * Add missing fix in dp_max_bpc_write (Harry Wentland) + +Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated") +Signed-off-by: Patrik Jakobsson +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +[ Cherry-pick the fix and drop the following functions which were introduced + since 5.13 or later: dp_max_bpc_write() was introduced in commit cca912e0a6b4 + ("drm/amd/display: Add max bpc debugfs") dp_dsc_passthrough_set() was + introduced in commit fcd1e484c8ae ("drm/amd/display: Add debugfs entry for + dsc passthrough"). ] +Signed-off-by: Xiangyu Chen +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +@@ -424,7 +424,7 @@ static ssize_t dp_phy_settings_write(str + if (!wr_buf) + return -ENOSPC; + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -576,7 +576,7 @@ static ssize_t dp_phy_test_pattern_debug + if (!wr_buf) + return -ENOSPC; + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -1091,7 +1091,7 @@ static ssize_t dp_trigger_hotplug(struct + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -1272,7 +1272,7 @@ static ssize_t dp_dsc_clock_en_write(str + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -1426,7 +1426,7 @@ static ssize_t dp_dsc_slice_width_write( + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -1580,7 +1580,7 @@ static ssize_t dp_dsc_slice_height_write + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { +@@ -1727,7 +1727,7 @@ static ssize_t dp_dsc_bits_per_pixel_wri + return -ENOSPC; + } + +- if (parse_write_buffer_into_params(wr_buf, size, ++ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, + (long *)param, buf, + max_param_num, + ¶m_nums)) { diff --git a/queue-5.10/series b/queue-5.10/series index a827d617e0..625e360022 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -86,6 +86,7 @@ arm64-dts-rockchip-add-missing-pcie-supplies-to-rockpro64-board-dtsi.patch mmc-atmel-mci-add-missing-clk_disable_unprepare.patch proc-fix-uaf-in-proc_get_inode.patch arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch +drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch soc-qcom-pdr-fix-the-potential-deadlock.patch drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch