Commit 434b1b66 authored by Patrik Jakobsson's avatar Patrik Jakobsson Committed by Kaixiong Yu
Browse files

drm/amdgpu: Fix even more out of bound writes from debugfs 

stable inclusion
from stable-v5.14.16
commit 9eb4bdd554fc31a5ef6bf645a20ff21618ce45a9
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RCVW
CVE: CVE-2021-47489

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9eb4bdd554fc31a5ef6bf645a20ff21618ce45a9



--------------------------------

commit 3f4e54bd upstream.

CVE-2021-42327 was fixed by:

commit f23750b5
Author: Thelford Williams <tdwilliamsiv@gmail.com>
Date:   Wed Oct 13 16:04:13 2021 -0400

    drm/amdgpu: fix out of bounds write

but amdgpu_dm_debugfs.c contains more of the same issue so fix the
remaining ones.

v2:
	* Add missing fix in dp_max_bpc_write (Harry Wentland)

Fixes: 918698d5 ("drm/amd/display: Return the number of bytes parsed than allocated")
Signed-off-by: default avatarPatrik Jakobsson <pjakobsson@suse.de>
Reviewed-by: default avatarHarry Wentland <harry.wentland@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarKaixiong Yu <yukaixiong@huawei.com>
parent c96c2b4f

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c

+7 −7
Original line number Diff line number Diff line
@@ -424,7 +424,7 @@ static ssize_t dp_phy_settings_write(struct file *f, const char __user *buf, 
	if (!wr_buf)

		return -ENOSPC;



	if (parse_write_buffer_into_params(wr_buf, size,

	if (parse_write_buffer_into_params(wr_buf, wr_buf_size,

					   (long *)param, buf,

					   max_param_num,

					   &param_nums)) {
@@ -576,7 +576,7 @@ static ssize_t dp_phy_test_pattern_debugfs_write(struct file *f, const char __us 
	if (!wr_buf)

		return -ENOSPC;



	if (parse_write_buffer_into_params(wr_buf, size,

	if (parse_write_buffer_into_params(wr_buf, wr_buf_size,

					   (long *)param, buf,

					   max_param_num,

					   &param_nums)) {
@@ -1091,7 +1091,7 @@ static ssize_t dp_trigger_hotplug(struct file *f, const char __user *buf, 
		return -ENOSPC;

	}



	if (parse_write_buffer_into_params(wr_buf, size,

	if (parse_write_buffer_into_params(wr_buf, wr_buf_size,

						(long *)param, buf,

						max_param_num,

						&param_nums)) {
@@ -1272,7 +1272,7 @@ static ssize_t dp_dsc_clock_en_write(struct file *f, const char __user *buf, 
		return -ENOSPC;

	}



	if (parse_write_buffer_into_params(wr_buf, size,

	if (parse_write_buffer_into_params(wr_buf, wr_buf_size,

					    (long *)param, buf,

					    max_param_num,

					    &param_nums)) {
@@ -1426,7 +1426,7 @@ static ssize_t dp_dsc_slice_width_write(struct file *f, const char __user *buf, 
		return -ENOSPC;

	}



	if (parse_write_buffer_into_params(wr_buf, size,

	if (parse_write_buffer_into_params(wr_buf, wr_buf_size,

					    (long *)param, buf,

					    max_param_num,

					    &param_nums)) {
@@ -1580,7 +1580,7 @@ static ssize_t dp_dsc_slice_height_write(struct file *f, const char __user *buf, 
		return -ENOSPC;

	}



	if (parse_write_buffer_into_params(wr_buf, size,

	if (parse_write_buffer_into_params(wr_buf, wr_buf_size,

					    (long *)param, buf,

					    max_param_num,

					    &param_nums)) {
@@ -1727,7 +1727,7 @@ static ssize_t dp_dsc_bits_per_pixel_write(struct file *f, const char __user *bu 
		return -ENOSPC;

	}



	if (parse_write_buffer_into_params(wr_buf, size,

	if (parse_write_buffer_into_params(wr_buf, wr_buf_size,

					    (long *)param, buf,

					    max_param_num,

					    &param_nums)) {