Commit f23750b5 authored by Thelford Williams's avatar Thelford Williams Committed by Alex Deucher
Browse files

drm/amdgpu: fix out of bounds write 



Size can be any value and is user controlled resulting in overwriting the
40 byte array wr_buf with an arbitrary length of data from buf.

Signed-off-by: default avatarThelford Williams <tdwilliamsiv@gmail.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 76c023fa

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c

+1 −1
Original line number Diff line number Diff line
@@ -264,7 +264,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf, 
	if (!wr_buf)

		return -ENOSPC;



	if (parse_write_buffer_into_params(wr_buf, size,

	if (parse_write_buffer_into_params(wr_buf, wr_buf_size,

					   (long *)param, buf,

					   max_param_num,

					   &param_nums)) {