linux-kernel - [PATCH] drm/amdgpu: fix double fetch in amdgpu_ras_debugfs_ctrl_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20190716111122.GA35069@ubuntu>
Date:   Tue, 16 Jul 2019 04:11:22 -0700
From:   JingYi Hou <houjingyi647@...il.com>
To:     alexander.deucher@....com, christian.koenig@....com,
        David1.Zhou@....com, airlied@...ux.ie, daniel@...ll.ch
Cc:     amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] drm/amdgpu: fix double fetch in
 amdgpu_ras_debugfs_ctrl_parse_data()

In amdgpu_ras_debugfs_ctrl_parse_data(), first fetch str from buf to
get op value, if op == -1 which means no command matched, fetch data
from buf again.

If change buf between two fetches may cause security problems or
unexpected behaivor. amdgpu_ras_debugfs_ctrl_parse_data() was called
by amdgpu_ras_debugfs_ctrl_write() and value of op was used later.

We should check whether data->op == -1 or not after second fetch. if
data->op != -1 means buf changed and should return -EINVAL.

Signed-off-by: JingYi Hou <houjingyi647@...il.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
index 22bd21efe6b1..845e73e98cd7 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c
@@ -233,6 +233,9 @@ static int amdgpu_ras_debugfs_ctrl_parse_data(struct file *f,

 		if (copy_from_user(data, buf, sizeof(*data)))
 			return -EINVAL;
+
+		if(data->op != -1)
+			return -EINVAL;
 	}

 	return 0;
--
2.20.1