drm/amdgpu: fix out of bounds write
commit 5afa7898 upstream. Size can be any value and is user controlled resulting in overwriting the 40 byte array wr_buf with an arbitrary length of data from buf. Signed-off-by:Thelford Williams <tdwilliamsiv@gmail.com> Signed-off-by:
Alex Deucher <alexander.deucher@amd.com> Cc: stable@vger.kernel.org Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
9eb4bdd5
Please register or sign in to comment