linux-kernel - [PATCH] drm/amd/amdgpu: default to zero number of states if not enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu,  6 Oct 2016 19:02:11 +0100
From:   Colin King <colin.king@...onical.com>
To:     Alex Deucher <alexander.deucher@....com>,
        Christian König <christian.koenig@....com>,
        David Airlie <airlied@...ux.ie>,
        Eric Huang <JinHuiEric.Huang@....com>,
        Rex Zhu <Rex.Zhu@....com>, Jammy Zhou <Jammy.Zhou@....com>,
        Tom St Denis <tom.stdenis@....com>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        dri-devel@...ts.freedesktop.org
Cc:     linux-kernel@...r.kernel.org
Subject: [PATCH] drm/amd/amdgpu: default to zero number of states if not enabled

From: Colin Ian King <colin.king@...onical.com>

Currently, if adev->pp_enabled is false then the pp_stats_info data
is not read and hence a garbage number of states from the stack
is used to dump out the number of states. Given data.nums could be
any random value, this could easily lead to read outside the
data.states array.  Fix this by setting data.nums to zero if
adev->pp_enabled is false.

Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index accc908..808d788 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -195,6 +195,8 @@ static ssize_t amdgpu_get_pp_num_states(struct device *dev,
 
 	if (adev->pp_enabled)
 		amdgpu_dpm_get_pp_num_states(adev, &data);
+	else
+		data.nums = 0;
 
 	buf_len = snprintf(buf, PAGE_SIZE, "states: %d\n", data.nums);
 	for (i = 0; i < data.nums; i++)
-- 
2.9.3