Commit cf851f3f authored Aug 25, 2020 by Alex Deucher

drm/amdgpu: Fix buffer overflow in INFO ioctl



The values for "se_num" and "sh_num" come from the user in the ioctl.
They can be in the 0-255 range but if they're more than
AMDGPU_GFX_MAX_SE (4) or AMDGPU_GFX_MAX_SH_PER_SE (2) then it results in
an out of bounds read.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

parent c997e8e2

drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -669,8 +669,12 @@ static int amdgpu_info_ioctl(struct drm_device dev, void data, struct drm_file
		* in the bitfields */
		if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK)
		se_num = 0xffffffff;
		else if (se_num >= AMDGPU_GFX_MAX_SE)
		return -EINVAL;
		if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK)
		sh_num = 0xffffffff;
		else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE)
		return -EINVAL;

		if (info->read_mmr_reg.count > 128)
		return -EINVAL;