]> git.itanic.dy.fi Git - linux-stable/commit
projects / linux-stable / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a73ea79) | patch
drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()
authorAlex Deucher <alexander.deucher@amd.com>
Fri, 28 Jul 2023 15:14:05 +0000 (11:14 -0400)
committerAlex Deucher <alexander.deucher@amd.com>
Wed, 9 Aug 2023 14:55:14 +0000 (10:55 -0400)
commit90e065677e0362a777b9db97ea21d43a39211399
treec2d1a5e3e7497b188f4722e29625d5f0ff0b936ftree | snapshot
parenta73ea79a0c94bacfab4df23a1043644d14f56591commit | diff
drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()

Since the gang_size check is outside of chunk parsing
loop, we need to reset i before we free the chunk data.

Suggested by Ye Zhang (@VAR10CK) of Baidu Security.

Reviewed-by: Guchun Chen <guchun.chen@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.