4.14-stable patches

added patches:
	drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch

diff --git a/queue-4.14/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch b/queue-4.14/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch
new file mode 100644 (file)
index 0000000..eaf50d9
--- /dev/null
+++ b/queue-4.14/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch
@@ -0,0 +1,39 @@
+From 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 3 Mar 2021 00:27:59 +0000
+Subject: drm/radeon: fix copy of uninitialized variable back to userspace
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 upstream.
+
+Currently the ioctl command RADEON_INFO_SI_BACKEND_ENABLED_MASK can
+copy back uninitialised data in value_tmp that pointer *value points
+to. This can occur when rdev->family is less than CHIP_BONAIRE and
+less than CHIP_TAHITI.  Fix this by adding in a missing -EINVAL
+so that no invalid value is copied back to userspace.
+
+Addresses-Coverity: ("Uninitialized scalar variable)
+Cc: stable@vger.kernel.org # 3.13+
+Fixes: 439a1cfffe2c ("drm/radeon: expose render backend mask to the userspace")
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_kms.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -531,6 +531,7 @@ static int radeon_info_ioctl(struct drm_
+                       *value = rdev->config.si.backend_enable_mask;
+               } else {
+                       DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n");
++                      return -EINVAL;
+               }
+               break;
+       case RADEON_INFO_MAX_SCLK:

diff --git a/queue-4.14/series b/queue-4.14/series
index ae57aa421c208d537857408a9ec048a63488f4a3..9a0784da7cd73d020716d728b432f9cd70d937cf 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -125,3 +125,4 @@ md-md_open-returns-ebusy-when-entering-racing-area.patch
 mips-reinstate-platform-__div64_32-handler.patch
 ipw2x00-potential-buffer-overflow-in-libipw_wx_set_encodeext.patch
 cfg80211-scan-drop-entry-from-hidden_list-on-overflow.patch
+drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch