lkml.org 
[lkml]   [2020]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.7 025/120] drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
    Date
    From: Peilin Ye <yepeilin.cs@gmail.com>

    commit 543e8669ed9bfb30545fd52bc0e047ca4df7fb31 upstream.

    Compiler leaves a 4-byte hole near the end of `dev_info`, causing
    amdgpu_info_ioctl() to copy uninitialized kernel stack memory to userspace
    when `size` is greater than 356.

    In 2015 we tried to fix this issue by doing `= {};` on `dev_info`, which
    unfortunately does not initialize that 4-byte hole. Fix it by using
    memset() instead.

    Cc: stable@vger.kernel.org
    Fixes: c193fa91b918 ("drm/amdgpu: information leak in amdgpu_info_ioctl()")
    Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
    Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
    +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
    @@ -692,9 +692,10 @@ static int amdgpu_info_ioctl(struct drm_
    return n ? -EFAULT : 0;
    }
    case AMDGPU_INFO_DEV_INFO: {
    - struct drm_amdgpu_info_device dev_info = {};
    + struct drm_amdgpu_info_device dev_info;
    uint64_t vm_size;

    + memset(&dev_info, 0, sizeof(dev_info));
    dev_info.device_id = dev->pdev->device;
    dev_info.chip_rev = adev->rev_id;
    dev_info.external_rev = adev->external_rev_id;

    \
     
     \ /
      Last update: 2020-08-03 14:57    [W:4.511 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site