diff options
Diffstat (limited to 'common/recipes-kernel/linux/files/0560-drm-amdgpu-integer-overflow-in-amdgpu_info_ioctl.patch')
| -rw-r--r-- | common/recipes-kernel/linux/files/0560-drm-amdgpu-integer-overflow-in-amdgpu_info_ioctl.patch | 46 |
1 files changed, 0 insertions, 46 deletions
diff --git a/common/recipes-kernel/linux/files/0560-drm-amdgpu-integer-overflow-in-amdgpu_info_ioctl.patch b/common/recipes-kernel/linux/files/0560-drm-amdgpu-integer-overflow-in-amdgpu_info_ioctl.patch deleted file mode 100644 index d7692bcf..00000000 --- a/common/recipes-kernel/linux/files/0560-drm-amdgpu-integer-overflow-in-amdgpu_info_ioctl.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 0d2edd3791bb172a59d708d5c94330bbd6050f97 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@oracle.com> -Date: Wed, 23 Sep 2015 14:00:12 +0300 -Subject: [PATCH 0560/1050] drm/amdgpu: integer overflow in amdgpu_info_ioctl() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The "alloc_size" calculation can overflow leading to memory corruption. - -Reviewed-by: Christian König <christian.koenig@amd.com> -Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> -Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -index 2236793..8c735f5 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -@@ -390,7 +390,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file - min((size_t)size, sizeof(vram_gtt))) ? -EFAULT : 0; - } - case AMDGPU_INFO_READ_MMR_REG: { -- unsigned n, alloc_size = info->read_mmr_reg.count * 4; -+ unsigned n, alloc_size; - uint32_t *regs; - unsigned se_num = (info->read_mmr_reg.instance >> - AMDGPU_INFO_MMR_SE_INDEX_SHIFT) & -@@ -406,9 +406,10 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file - if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) - sh_num = 0xffffffff; - -- regs = kmalloc(alloc_size, GFP_KERNEL); -+ regs = kmalloc_array(info->read_mmr_reg.count, sizeof(*regs), GFP_KERNEL); - if (!regs) - return -ENOMEM; -+ alloc_size = info->read_mmr_reg.count * sizeof(*regs); - - for (i = 0; i < info->read_mmr_reg.count; i++) - if (amdgpu_asic_read_register(adev, se_num, sh_num, --- -1.9.1 - |