diff mbox series

[5.8,214/255] drm/amdgpu: Fix buffer overflow in INFO ioctl

Message ID	20200901151010.957910511@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=oSvm=CK=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>, Alex Deucher <alexander.deucher@amd.com> Subject: [PATCH 5.8 214/255] drm/amdgpu: Fix buffer overflow in INFO ioctl Date: Tue, 1 Sep 2020 17:11:10 +0200 Message-Id: <20200901151010.957910511@linuxfoundation.org> In-Reply-To: <20200901151000.800754757@linuxfoundation.org> References: <20200901151000.800754757@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.8,002/255] ASoC: intel/skl/hda - fix probe regression on systems without i915 [5.8,003/255] ALSA: hda/hdmi: Add quirk to force connectivity [5.8,004/255] ALSA: pci: delete repeated words in comments [5.8,005/255] ALSA: hda/realtek: Fix pin default on Intel NUC 8 Rugged [5.8,006/255] ALSA: hda/hdmi: Use force connectivity quirk on another HP desktop [5.8,007/255] drm/amdgpu: fix RAS memory leak in error case [5.8,008/255] EDAC/mc: Call edac_inc_ue_error() before panic [5.8,009/255] ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt [5.8,010/255] ASoC: img-parallel-out: Fix a reference count leak [5.8,011/255] ASoC: tegra: Fix reference count leaks. [5.8,012/255] mfd: intel-lpss: Add Intel Emmitsburg PCH PCI IDs [5.8,013/255] arm64: dts: qcom: msm8916: Pull down PDM GPIOs during sleep [5.8,014/255] powerpc/xive: Ignore kmemleak false positives [5.8,015/255] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in ... [5.8,016/255] gcc-plugins/stackleak: Dont instrument itself [5.8,017/255] blktrace: ensure our debugfs dir exists [5.8,018/255] staging: rts5208: fix memleaks on error handling paths in probe [5.8,019/255] scsi: target: tcmu: Fix crash on ARM during cmd completion [5.8,020/255] mfd: intel-lpss: Add Intel Tiger Lake PCH-H PCI IDs [5.8,021/255] iommu/iova: Dont BUG on invalid PFNs [5.8,022/255] platform/chrome: cros_ec_sensorhub: Fix EC timestamp overflow [5.8,023/255] drm/amdkfd: Fix reference count leaks. [5.8,024/255] drm/radeon: fix multiple reference count leak [5.8,025/255] drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms [5.8,026/255] drm/amd/display: fix ref count leak in amdgpu_drm_ioctl [5.8,027/255] drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config [5.8,028/255] drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails [5.8,029/255] drm/amdgpu/fence: fix ref count leak when pm_runtime_get_sync fails [5.8,030/255] drm/amdkfd: fix ref count leak when pm_runtime_get_sync fails [5.8,031/255] drm/amdgpu/pm: fix ref count leak when pm_runtime_get_sync fails [5.8,032/255] scsi: lpfc: Fix shost refcount mismatch when deleting vport [5.8,033/255] xfs: Dont allow logging of XFS_ISTALE inodes [5.8,034/255] scsi: target: Fix xcopy sess release leak [5.8,035/255] selftests/powerpc: Purge extra count_pmc() calls of ebb selftests [5.8,036/255] f2fs: remove write attribute of main_blkaddr sysfs node [5.8,037/255] f2fs: fix error path in do_recover_data() [5.8,038/255] MIPS: KVM: Limit Trap-and-Emulate to MIPS32R2 only [5.8,039/255] omapfb: fix multiple reference count leaks due to pm_runtime_get_sync [5.8,040/255] PCI: Fix pci_create_slot() reference count leak [5.8,041/255] ARM: dts: ls1021a: output PPS signal on FIPER2 [5.8,042/255] rtlwifi: rtl8192cu: Prevent leaking urb [5.8,043/255] mips/vdso: Fix resource leaks in genvdso.c [5.8,044/255] ALSA: hda: Add support for Loongson 7A1000 controller [5.8,045/255] gpu: host1x: Put gathers BO on pinning error [5.8,046/255] cec-api: prevent leaking memory through hole in structure [5.8,047/255] ASoC: Intel: sof_sdw_rt711: remove properties in card remove [5.8,048/255] HID: quirks: add NOGET quirk for Logitech GROUP [5.8,049/255] f2fs: fix use-after-free issue [5.8,050/255] drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open [5.8,051/255] drm/nouveau: fix reference count leak in nv50_disp_atomic_commit [5.8,052/255] drm/nouveau: Fix reference count leak in nouveau_connector_detect [5.8,053/255] locking/lockdep: Fix overflow in presentation of average lock-time [5.8,054/255] btrfs: file: reserve qgroup space after the hole punch range is locked [5.8,055/255] btrfs: make btrfs_qgroup_check_reserved_leak take btrfs_inode [5.8,056/255] scsi: iscsi: Do not put host in iscsi_set_flashnode_param() [5.8,057/255] netfilter: nf_tables: report EEXIST on overlaps [5.8,058/255] ceph: fix potential mdsc use-after-free crash [5.8,059/255] ceph: do not access the kiocb after aio requests [5.8,060/255] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() [5.8,061/255] i2c: i801: Add support for Intel Tiger Lake PCH-H [5.8,062/255] EDAC/ie31200: Fallback if host bridge device is already initialized [5.8,063/255] hugetlbfs: prevent filesystem stacking of hugetlbfs [5.8,064/255] media: davinci: vpif_capture: fix potential double free [5.8,065/255] media: i2c: imx290: fix reset GPIO pin handling [5.8,066/255] drm/amd/display: change global buffer to local buffer [5.8,067/255] drm/amd/display: fix compilation error on allmodconfig [5.8,068/255] KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe [5.8,069/255] powerpc/spufs: add CONFIG_COREDUMP dependency [5.8,070/255] dmaengine: idxd: fix PCI_MSI build errors [5.8,071/255] USB: sisusbvga: Fix a potential UB casued by left shifting a negative value [5.8,072/255] mmc: sdhci-of-arasan: fix timings allocation code [5.8,073/255] brcmfmac: Set timeout value when configuring power save [5.8,074/255] pinctrl: mediatek: avoid virtual gpio trying to set reg [5.8,075/255] pinctrl: mediatek: fix build for tristate changes [5.8,076/255] efi: provide empty efi_enter_virtual_mode implementation [5.8,077/255] arm64: Fix __cpu_logical_map undefined issue [5.8,078/255] net: openvswitch: introduce common code for flushing flows [5.8,079/255] PCI: qcom: Add missing ipq806x clocks in PCIe driver [5.8,080/255] PCI: qcom: Change duplicate PCI reset to phy reset [5.8,081/255] PCI: qcom: Add missing reset for ipq806x [5.8,082/255] PM / devfreq: Fix the wrong end with semicolon [5.8,083/255] cpufreq: intel_pstate: Fix EPP setting via sysfs in active mode [5.8,084/255] ALSA: usb-audio: Add capture support for Saffire 6 (USB 1.1) [5.8,085/255] nfsd: fix oops on mixed NFSv4/NFSv3 client access [5.8,086/255] block: respect queue limit of max discard segment [5.8,087/255] block: virtio_blk: fix handling single range discard request [5.8,088/255] drm/msm/adreno: fix updating ring fence [5.8,089/255] block: Fix page_is_mergeable() for compound pages [5.8,090/255] bfq: fix blkio cgroup leakage v4 [5.8,091/255] hwmon: (nct7904) Correct divide by 0 [5.8,092/255] blk-mq: insert request not through ->queue_rq into sw/scheduler queue [5.8,093/255] blkcg: fix memleak for iolatency [5.8,094/255] nvmet: fix a memory leak [5.8,095/255] nvme-fc: Fix wrong return value in __nvme_fc_init_request() [5.8,096/255] nvme: multipath: round-robin: fix single non-optimized path case [5.8,097/255] null_blk: fix passing of REQ_FUA flag in null_handle_rq [5.8,098/255] habanalabs: Fix memory corruption in debugfs [5.8,099/255] drm/etnaviv: always start/stop scheduler in timeout processing [5.8,100/255] i2c: core: Dont fail PRP0001 enumeration when no ID table exist [5.8,101/255] i2c: rcar: in slave mode, clear NACK earlier [5.8,102/255] vdpa: ifcvf: return err when fail to request config irq [5.8,103/255] vdpa: ifcvf: free config irq in ifcvf_free_irq() [5.8,104/255] usb: gadget: f_tcm: Fix some resource leaks in some error paths [5.8,105/255] video: fbdev: controlfb: Fix build for COMPILE_TEST=y && PPC_PMAC=n [5.8,106/255] spi: stm32: clear only asserted irq flags on interrupt [5.8,107/255] jbd2: make sure jh have b_transaction set in refile/unfile_buffer [5.8,108/255] ext4: dont BUG on inconsistent journal feature [5.8,109/255] ext4: handle read only external journal device [5.8,110/255] ext4: skip non-loaded groups at cr=0/1 when scanning for good groups [5.8,111/255] drm/virtio: fix memory leak in virtio_gpu_cleanup_object() [5.8,112/255] ext4: abort the filesystem if failed to async write metadata buffer [5.8,113/255] jbd2: abort journal if free a async write error metadata buffer [5.8,114/255] ext4: handle option set by mount flags correctly [5.8,115/255] ext4: handle error of ext4_setup_system_zone() on remount [5.8,116/255] ext4: correctly restore system zone info when remount fails [5.8,117/255] fs: prevent BUG_ON in submit_bh_wbc() [5.8,118/255] spi: stm32h7: fix race condition at end of transfer [5.8,119/255] spi: stm32: fix fifo threshold level in case of short transfer [5.8,120/255] spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate [5.8,121/255] spi: stm32: always perform registers configuration prior to transfer [5.8,122/255] drm/amd/powerplay: correct Vega20 cached smu feature state [5.8,123/255] drm/amd/powerplay: correct UVD/VCE PG state on custom pptable uploading [5.8,124/255] drm/amd/display: Fix LFC multiplier changing erratically [5.8,125/255] drm/amd/display: Switch to immediate mode for updating infopackets [5.8,126/255] selftests/bpf: Fix segmentation fault in test_progs [5.8,127/255] libbpf: Handle GCC built-in types for Arm NEON [5.8,128/255] netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency [5.8,129/255] libbpf: Prevent overriding errno when logging errors [5.8,130/255] tools/bpftool: Fix compilation warnings in 32-bit mode [5.8,131/255] selftest/bpf: Fix compilation warnings in 32-bit mode [5.8,132/255] selftests/bpf: Fix btf_dump test cases on 32-bit arches [5.8,133/255] selftests/bpf: Correct various core_reloc 64-bit assumptions [5.8,134/255] can: j1939: transport: j1939_xtp_rx_dat_one(): compare own packets to detect corrup... [5.8,135/255] dma-pool: fix coherent pool allocations for IOMMU mappings [5.8,136/255] dma-pool: Only allocate from CMA when in same memory zone [5.8,137/255] drivers/net/wan/hdlc_x25: Added needed_headroom and a skb->len check [5.8,138/255] ALSA: hda/realtek: Add model alc298-samsung-headphone [5.8,139/255] s390/cio: add cond_resched() in the slow_eval_known_fn() loop [5.8,140/255] ASoC: wm8994: Avoid attempts to read unreadable registers [5.8,141/255] ALSA: usb-audio: ignore broken processing/extension unit [5.8,142/255] selftests: disable rp_filter for icmp_redirect.sh [5.8,143/255] scsi: fcoe: Fix I/O path allocation [5.8,144/255] scsi: ufs: Fix possible infinite loop in ufshcd_hold [5.8,145/255] scsi: ufs: Improve interrupt handling for shared interrupts [5.8,146/255] scsi: ufs: Clean up completed request without interrupt notification [5.8,147/255] scsi: scsi_debug: Fix scp is NULL errors [5.8,148/255] scsi: qla2xxx: Flush all sessions on zone disable [5.8,149/255] scsi: qla2xxx: Flush I/O on zone disable [5.8,150/255] scsi: qla2xxx: Indicate correct supported speeds for Mezz card [5.8,151/255] scsi: qla2xxx: Fix login timeout [5.8,152/255] scsi: qla2xxx: Check if FW supports MQ before enabling [5.8,153/255] scsi: qla2xxx: Fix null pointer access during disconnect from subsystem [5.8,154/255] Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" [5.8,155/255] macvlan: validate setting of multiple remote source MAC addresses [5.8,156/255] net: gianfar: Add of_node_put() before goto statement [5.8,157/255] drm/amdgpu: fix NULL pointer access issue when unloading driver [5.8,158/255] drm/amdkfd: fix the wrong sdma instance query for renoir [5.8,159/255] bpf: Fix a rcu_sched stall issue with bpf task/task_file iterator [5.8,160/255] bpf: Avoid visit same object multiple times [5.8,161/255] ext4: limit the length of per-inode prealloc list [5.8,162/255] powerpc/perf: Fix soft lockups due to missed interrupt accounting [5.8,163/255] libbpf: Fix map index used in error message [5.8,164/255] bpf: selftests: global_funcs: Check err_str before strstr [5.8,165/255] arm64: Move handling of erratum 1418040 into C code [5.8,166/255] arm64: Allow booting of late CPUs affected by erratum 1418040 [5.8,167/255] hwmon: (gsc-hwmon) Scale temperature to millidegrees [5.8,168/255] block: fix get_max_io_size() [5.8,169/255] block: loop: set discard granularity and alignment for block device backed loop [5.8,170/255] HID: i2c-hid: Always sleep 60ms after I2C_HID_PWR_ON commands [5.8,171/255] blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART [5.8,172/255] btrfs: reset compression level for lzo on remount [5.8,173/255] btrfs: check the right error variable in btrfs_del_dir_entries_in_log [5.8,174/255] btrfs: fix space cache memory leak after transaction abort [5.8,175/255] btrfs: detect nocow for swap after snapshot delete [5.8,176/255] fbcon: prevent user font height or width change from causing potential out-of-bound... [5.8,177/255] USB: lvtest: return proper error code in probe [5.8,178/255] vt: defer kfree() of vc_screenbuf in vc_do_resize() [5.8,179/255] vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() [5.8,180/255] serial: samsung: Removes the IRQ not found warning [5.8,181/255] serial: pl011: Fix oops on -EPROBE_DEFER [5.8,182/255] serial: pl011: Dont leak amba_ports entry on driver register error [5.8,183/255] serial: stm32: avoid kernel warning on absence of optional IRQ [5.8,184/255] serial: 8250_exar: Fix number of ports for Commtech PCIe cards [5.8,185/255] serial: 8250: change lock order in serial8250_do_startup() [5.8,186/255] io_uring: clear req->result on IOPOLL re-issue [5.8,187/255] writeback: Protect inode->i_io_list with inode->i_lock [5.8,188/255] writeback: Avoid skipping inode writeback [5.8,189/255] writeback: Fix sync livelock due to b_dirty_time processing [5.8,190/255] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data p... [5.8,191/255] usb: renesas-xhci: remove version check [5.8,192/255] usb: host: xhci-tegra: otg usb2/usb3 port init [5.8,193/255] usb: host: xhci-tegra: fix tegra_xusb_get_phy() [5.8,194/255] usb: host: xhci: fix ep context print mismatch in debugfs [5.8,195/255] xhci: Do warm-reset when both CAS and XDEV_RESUME are set [5.8,196/255] xhci: Always restore EP_SOFT_CLEAR_TOGGLE even if ep reset failed [5.8,197/255] io-wq: fix hang after cancelling pending hashed work [5.8,198/255] KVM: arm64: Set HCR_EL2.PTW to prevent AT taking synchronous exception [5.8,199/255] arm64: vdso32: make vdso32 install conditional [5.8,200/255] PM: sleep: core: Fix the handling of pending runtime resume requests [5.8,201/255] powerpc/32s: Disable VMAP stack which CONFIG_ADB_PMU [5.8,202/255] powerpc/perf: Fix crashes with generic_compat_pmu & BHRB [5.8,203/255] device property: Fix the secondary firmware node handling in set_primary_fwnode() [5.8,204/255] crypto: af_alg - Work around empty control messages without MSG_MORE [5.8,205/255] usbip: Implement a match function to fix usbip [5.8,206/255] genirq/matrix: Deal with the sillyness of for_each_cpu() on UP [5.8,207/255] irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake [5.8,208/255] x86/irq: Unbreak interrupt affinity setting [5.8,209/255] x86/hotplug: Silence APIC only after all interrupts are migrated [5.8,210/255] drm/i915: Fix cmd parser desc matching with masks [5.8,211/255] drm/etnaviv: fix external abort seen on GC600 rev 0x19 [5.8,212/255] drm/dp_mst: Dont return error code when crtc is null [5.8,213/255] drm/modeset-lock: Take the modeset BKL for legacy drivers [5.8,214/255] drm/amdgpu: Fix buffer overflow in INFO ioctl [5.8,215/255] drm/amd/display: use correct scale for actual_brightness [5.8,216/255] drm/amdgpu/gfx10: refine mgcg setting [5.8,217/255] drm/amd/powerplay: Fix hardmins not being sent to SMU for RV [5.8,218/255] drm/amd/pm: correct Vega10 swctf limit setting [5.8,219/255] drm/amd/pm: correct Vega12 swctf limit setting [5.8,220/255] drm/amd/pm: correct Vega20 swctf limit setting [5.8,221/255] drm/amd/pm: correct the thermal alert temperature limit settings [5.8,222/255] USB: yurex: Fix bad gfp argument [5.8,223/255] usb: uas: Add quirk for PNY Pro Elite [5.8,224/255] USB: quirks: Add no-lpm quirk for another Raydium touchscreen [5.8,225/255] USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D [5.8,226/255] USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge [5.8,227/255] usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() [5.8,228/255] USB: gadget: u_f: add overflow checks to VLA macros [5.8,229/255] USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb() [5.8,230/255] USB: gadget: u_f: Unbreak offset calculation in VLAs [5.8,231/255] usb: dwc3: gadget: Dont setup more than requested [5.8,232/255] usb: dwc3: gadget: Fix handling ZLP [5.8,233/255] usb: dwc3: gadget: Handle ZLP for sg requests [5.8,234/255] USB: cdc-acm: rework notification_buffer resizing [5.8,235/255] usb: storage: Add unusual_uas entry for Sony PSZ drives [5.8,236/255] USB: Also match device drivers using the ->match vfunc [5.8,237/255] USB: Fix device driver race [5.8,238/255] usb: typec: ucsi: Fix AB BA lock inversion [5.8,239/255] usb: typec: ucsi: Fix 2 unlocked ucsi_run_command calls [5.8,240/255] usb: typec: ucsi: Rework ppm_lock handling [5.8,241/255] usb: typec: ucsi: Hold con->lock for the entire duration of ucsi_register_port() [5.8,242/255] usb: typec: tcpm: Fix Fix source hard reset response for TDA 2.3.1.1 and TDA 2.3.1.... [5.8,243/255] io_uring: dont recurse on tsk->sighand->siglock with signalfd [5.8,244/255] io_uring: dont use poll handler if file cant be nonblocking read/written [5.8,245/255] io_uring: make offset == -1 consistent with preadv2/pwritev2 [5.8,246/255] drm/atomic-helper: reset vblank on crtc reset [5.8,247/255] fbmem: pull fbcon_update_vcs() out of fb_set_var() [5.8,248/255] mm/page_counter: fix various data races at memsw [5.8,249/255] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() [5.8,250/255] drm/vmwgfx/stdu: Use drm_mode_config_reset [5.8,251/255] drm/vmwgfx/sou: Use drm_mode_config_reset [5.8,252/255] drm/vmwgfx/ldu: Use drm_mode_config_reset [5.8,253/255] libbpf: Fix build on ppc64le architecture [5.8,254/255] dma-pool: Fix an uninitialized variable bug in atomic_pool_expand() [5.8,255/255] ALSA: usb-audio: Update documentation comment for MS2109 quirk

Commit Message

Greg KH Sept. 1, 2020, 3:11 p.m. UTC

From: Alex Deucher <alexander.deucher@amd.com>

commit b5b97cab55eb71daba3283c8b1d2cce456d511a1 upstream.

The values for "se_num" and "sh_num" come from the user in the ioctl.
They can be in the 0-255 range but if they're more than
AMDGPU_GFX_MAX_SE (4) or AMDGPU_GFX_MAX_SH_PER_SE (2) then it results in
an out of bounds read.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c |    4 ++++
 1 file changed, 4 insertions(+)

diff mbox series

Patch

--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -663,8 +663,12 @@  static int amdgpu_info_ioctl(struct drm_
 		 * in the bitfields */
 		if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK)
 			se_num = 0xffffffff;
+		else if (se_num >= AMDGPU_GFX_MAX_SE)
+			return -EINVAL;
 		if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK)
 			sh_num = 0xffffffff;
+		else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE)
+			return -EINVAL;
 
 		if (info->read_mmr_reg.count > 128)
 			return -EINVAL;