From: Greg Kroah-Hartman Date: Wed, 12 May 2021 09:53:55 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.4.119~66 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d43eaccb2a5ffe41125b8eab752809876773c99f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch --- diff --git a/queue-4.14/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch b/queue-4.14/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch new file mode 100644 index 00000000000..eaf50d94270 --- /dev/null +++ b/queue-4.14/drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch @@ -0,0 +1,39 @@ +From 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Wed, 3 Mar 2021 00:27:59 +0000 +Subject: drm/radeon: fix copy of uninitialized variable back to userspace +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Colin Ian King + +commit 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 upstream. + +Currently the ioctl command RADEON_INFO_SI_BACKEND_ENABLED_MASK can +copy back uninitialised data in value_tmp that pointer *value points +to. This can occur when rdev->family is less than CHIP_BONAIRE and +less than CHIP_TAHITI. Fix this by adding in a missing -EINVAL +so that no invalid value is copied back to userspace. + +Addresses-Coverity: ("Uninitialized scalar variable) +Cc: stable@vger.kernel.org # 3.13+ +Fixes: 439a1cfffe2c ("drm/radeon: expose render backend mask to the userspace") +Reviewed-by: Christian König +Signed-off-by: Colin Ian King +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/radeon_kms.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -531,6 +531,7 @@ static int radeon_info_ioctl(struct drm_ + *value = rdev->config.si.backend_enable_mask; + } else { + DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n"); ++ return -EINVAL; + } + break; + case RADEON_INFO_MAX_SCLK: diff --git a/queue-4.14/series b/queue-4.14/series index ae57aa421c2..9a0784da7cd 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -125,3 +125,4 @@ md-md_open-returns-ebusy-when-entering-racing-area.patch mips-reinstate-platform-__div64_32-handler.patch ipw2x00-potential-buffer-overflow-in-libipw_wx_set_encodeext.patch cfg80211-scan-drop-entry-from-hidden_list-on-overflow.patch +drm-radeon-fix-copy-of-uninitialized-variable-back-to-userspace.patch