diff options
Diffstat (limited to 'common/recipes-kernel/linux/files/0561-drm-amdgpu-info-leak-in-amdgpu_gem_metadata_ioctl.patch')
| -rw-r--r-- | common/recipes-kernel/linux/files/0561-drm-amdgpu-info-leak-in-amdgpu_gem_metadata_ioctl.patch | 46 |
1 files changed, 0 insertions, 46 deletions
diff --git a/common/recipes-kernel/linux/files/0561-drm-amdgpu-info-leak-in-amdgpu_gem_metadata_ioctl.patch b/common/recipes-kernel/linux/files/0561-drm-amdgpu-info-leak-in-amdgpu_gem_metadata_ioctl.patch deleted file mode 100644 index 945ad485..00000000 --- a/common/recipes-kernel/linux/files/0561-drm-amdgpu-info-leak-in-amdgpu_gem_metadata_ioctl.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 0913eab648e4fb30ddca8882e707d0fcf5b237c6 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter <dan.carpenter@oracle.com> -Date: Wed, 23 Sep 2015 14:00:35 +0300 -Subject: [PATCH 0561/1050] drm/amdgpu: info leak in - amdgpu_gem_metadata_ioctl() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -There is no limit on args->data.data_size_bytes so we could read beyond -the end of the args->data.data[] array. - -Reviewed-by: Christian König <christian.koenig@amd.com> -Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> -Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -Signed-off-by: Alex Deucher <alexander.deucher@amd.com> ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c -index 2f39fea..b82fab2 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c -@@ -427,6 +427,10 @@ int amdgpu_gem_metadata_ioctl(struct drm_device *dev, void *data, - &args->data.data_size_bytes, - &args->data.flags); - } else if (args->op == AMDGPU_GEM_METADATA_OP_SET_METADATA) { -+ if (args->data.data_size_bytes > sizeof(args->data.data)) { -+ r = -EINVAL; -+ goto unreserve; -+ } - r = amdgpu_bo_set_tiling_flags(robj, args->data.tiling_info); - if (!r) - r = amdgpu_bo_set_metadata(robj, args->data.data, -@@ -434,6 +438,7 @@ int amdgpu_gem_metadata_ioctl(struct drm_device *dev, void *data, - args->data.flags); - } - -+unreserve: - amdgpu_bo_unreserve(robj); - out: - drm_gem_object_unreference_unlocked(gobj); --- -1.9.1 - |