diff options
| author | Thelford Williams <tdwilliamsiv@gmail.com> | 2021-10-13 16:04:13 -0400 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2021-10-13 22:20:03 -0400 |
| commit | f23750b5b3d98653b31d4469592935ef6364ad67 (patch) | |
| tree | 0d43f5aeb41319c5be006fdcbbd8746c58202a12 | |
| parent | 76c023fac32a191c51b16d811b1a311a827691f6 (diff) | |
| download | linux-f23750b5b3d98653b31d4469592935ef6364ad67.tar.bz2 | |
drm/amdgpu: fix out of bounds write
Size can be any value and is user controlled resulting in overwriting the
40 byte array wr_buf with an arbitrary length of data from buf.
Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index 814f67d86a3c..9b3ad56607bb 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -264,7 +264,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf, if (!wr_buf) return -ENOSPC; - if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) { |