* [PATCH] drm/amdgpu: fix out of bounds write
@ 2021-10-13 20:04 T. Williams
2021-10-13 20:40 ` Alex Deucher
0 siblings, 1 reply; 7+ messages in thread
From: T. Williams @ 2021-10-13 20:04 UTC (permalink / raw)
To: harry.wentland, sunpeng.li, airlied, Daniel Vetter, Wayne.Lin,
mikita.lipski, Nicholas.Kazlauskas, stylon.wang, eryk.brol,
Jerry.Zuo, victorchengchi.lu, aurabindo.pillai, nirmoy.das,
Anson.Jacob, amd-gfx
[-- Attachment #1: Type: text/plain, Size: 1070 bytes --]
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index 87daa78a32b8..17f2756a64dc 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -263,7 +263,7 @@ static ssize_t dp_link_settings_write(struct file *f,
const char __user *buf,
if (!wr_buf)
return -ENOSPC;
- if (parse_write_buffer_into_params(wr_buf, size,
+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
(long *)param, buf,
max_param_num,
¶m_nums)) {
--
Size can be any value and is user controlled resulting in overwriting the
40 byte array wr_buf with an arbitrary length of data from buf.
Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
[-- Attachment #2: Type: text/html, Size: 1637 bytes --]
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] drm/amdgpu: fix out of bounds write
2021-10-13 20:04 [PATCH] drm/amdgpu: fix out of bounds write T. Williams
@ 2021-10-13 20:40 ` Alex Deucher
2021-10-27 10:08 ` Patrik Jakobsson
0 siblings, 1 reply; 7+ messages in thread
From: Alex Deucher @ 2021-10-13 20:40 UTC (permalink / raw)
To: T. Williams
Cc: Wentland, Harry, Leo (Sunpeng) Li, Dave Airlie, Daniel Vetter,
Wayne Lin, Lipski, Mikita, Kazlauskas, Nicholas, Stylon Wang,
Eryk Brol, Jerry Zuo, Victor Lu, Aurabindo Pillai, Nirmoy Das,
Anson Jacob, amd-gfx list
On Wed, Oct 13, 2021 at 4:04 PM T. Williams <tdwilliamsiv@gmail.com> wrote:
>
The description and s-o-b should go here and the patch seems to be
mangled. I've manually applied this. Please fix up your mailer in
the future.
Thanks for the fix.
Alex
> ---
> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> index 87daa78a32b8..17f2756a64dc 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> @@ -263,7 +263,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf,
> if (!wr_buf)
> return -ENOSPC;
>
> - if (parse_write_buffer_into_params(wr_buf, size,
> + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> (long *)param, buf,
> max_param_num,
> ¶m_nums)) {
> --
>
> Size can be any value and is user controlled resulting in overwriting the 40 byte array wr_buf with an arbitrary length of data from buf.
>
> Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] drm/amdgpu: fix out of bounds write
2021-10-13 20:40 ` Alex Deucher
@ 2021-10-27 10:08 ` Patrik Jakobsson
2021-10-27 13:05 ` Patrik Jakobsson
0 siblings, 1 reply; 7+ messages in thread
From: Patrik Jakobsson @ 2021-10-27 10:08 UTC (permalink / raw)
To: Alex Deucher
Cc: T. Williams, Wentland, Harry, Leo (Sunpeng) Li, Dave Airlie,
Daniel Vetter, Wayne Lin, Lipski, Mikita, Kazlauskas, Nicholas,
Stylon Wang, Eryk Brol, Jerry Zuo, Victor Lu, Aurabindo Pillai,
Nirmoy Das, Anson Jacob, amd-gfx list
On Wed, Oct 13, 2021 at 10:41 PM Alex Deucher <alexdeucher@gmail.com> wrote:
>
> On Wed, Oct 13, 2021 at 4:04 PM T. Williams <tdwilliamsiv@gmail.com> wrote:
> >
>
> The description and s-o-b should go here and the patch seems to be
> mangled. I've manually applied this. Please fix up your mailer in
> the future.
>
> Thanks for the fix.
Hi Thelford and Alex
There are several more instances of size being used instead of
wr_buf_size in amdgpu_dm_debugfs.c.
IMO the proper fix here would be to revert
918698d5c2b50433714d2042f55b55b090faa167
-Patrik
>
> Alex
>
>
> > ---
> > drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > index 87daa78a32b8..17f2756a64dc 100644
> > --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > @@ -263,7 +263,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf,
> > if (!wr_buf)
> > return -ENOSPC;
> >
> > - if (parse_write_buffer_into_params(wr_buf, size,
> > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> > (long *)param, buf,
> > max_param_num,
> > ¶m_nums)) {
> > --
> >
> > Size can be any value and is user controlled resulting in overwriting the 40 byte array wr_buf with an arbitrary length of data from buf.
> >
> > Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] drm/amdgpu: fix out of bounds write
2021-10-27 10:08 ` Patrik Jakobsson
@ 2021-10-27 13:05 ` Patrik Jakobsson
0 siblings, 0 replies; 7+ messages in thread
From: Patrik Jakobsson @ 2021-10-27 13:05 UTC (permalink / raw)
To: Alex Deucher
Cc: T. Williams, Wentland, Harry, Leo (Sunpeng) Li, Dave Airlie,
Daniel Vetter, Wayne Lin, Lipski, Mikita, Kazlauskas, Nicholas,
Stylon Wang, Eryk Brol, Jerry Zuo, Victor Lu, Aurabindo Pillai,
Nirmoy Das, Anson Jacob, amd-gfx list
On Wed, Oct 27, 2021 at 12:08 PM Patrik Jakobsson
<patrik.r.jakobsson@gmail.com> wrote:
>
> On Wed, Oct 13, 2021 at 10:41 PM Alex Deucher <alexdeucher@gmail.com> wrote:
> >
> > On Wed, Oct 13, 2021 at 4:04 PM T. Williams <tdwilliamsiv@gmail.com> wrote:
> > >
> >
> > The description and s-o-b should go here and the patch seems to be
> > mangled. I've manually applied this. Please fix up your mailer in
> > the future.
> >
> > Thanks for the fix.
>
> Hi Thelford and Alex
>
> There are several more instances of size being used instead of
> wr_buf_size in amdgpu_dm_debugfs.c.
>
> IMO the proper fix here would be to revert
> 918698d5c2b50433714d2042f55b55b090faa167
Actually, there's one instance that a revert doesn't cover. Instead I
sent out a patch to fix the remaining ones.
>
> -Patrik
>
> >
> > Alex
> >
> >
> > > ---
> > > drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > > index 87daa78a32b8..17f2756a64dc 100644
> > > --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > > +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> > > @@ -263,7 +263,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf,
> > > if (!wr_buf)
> > > return -ENOSPC;
> > >
> > > - if (parse_write_buffer_into_params(wr_buf, size,
> > > + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> > > (long *)param, buf,
> > > max_param_num,
> > > ¶m_nums)) {
> > > --
> > >
> > > Size can be any value and is user controlled resulting in overwriting the 40 byte array wr_buf with an arbitrary length of data from buf.
> > >
> > > Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] drm/amdgpu: fix out of bounds write
2021-10-27 15:22 ` Harry Wentland
@ 2021-10-27 15:59 ` Guenter Roeck
0 siblings, 0 replies; 7+ messages in thread
From: Guenter Roeck @ 2021-10-27 15:59 UTC (permalink / raw)
To: Harry Wentland, Thelford Williams
Cc: amd-gfx, dri-devel, linux-kernel, David Airlie, Alex Deucher,
Patrik Jakobsson
On 10/27/21 8:22 AM, Harry Wentland wrote:
> On 2021-10-27 10:39, Guenter Roeck wrote:
>> On Wed, Oct 13, 2021 at 04:04:13PM -0400, Thelford Williams wrote:
>>> Size can be any value and is user controlled resulting in overwriting the
>>> 40 byte array wr_buf with an arbitrary length of data from buf.
>>>
>>> Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
>>> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
>>
>> The fix works, but unless I am missing something it is incomplete.
>> parse_write_buffer_into_params() is called several times, and the
>> size parameter is always wrong. This patch only fixes one of several
>> instances of the problem.
>>
>
> Patrik sent a patch that covers all cases:
> https://patchwork.freedesktop.org/patch/461554/?series=96341&rev=2
>
> Harry
>
Thanks!
Guenter
>> Guenter
>>
>>> ---
>>> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
>>> index 814f67d86a3c..9b3ad56607bb 100644
>>> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
>>> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
>>> @@ -264,7 +264,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf,
>>> if (!wr_buf)
>>> return -ENOSPC;
>>>
>>> - if (parse_write_buffer_into_params(wr_buf, size,
>>> + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
>>> (long *)param, buf,
>>> max_param_num,
>>> ¶m_nums)) {
>>> --
>>> 2.33.0
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] drm/amdgpu: fix out of bounds write
2021-10-27 14:39 Guenter Roeck
@ 2021-10-27 15:22 ` Harry Wentland
2021-10-27 15:59 ` Guenter Roeck
0 siblings, 1 reply; 7+ messages in thread
From: Harry Wentland @ 2021-10-27 15:22 UTC (permalink / raw)
To: Guenter Roeck, Thelford Williams
Cc: amd-gfx, dri-devel, linux-kernel, David Airlie, Alex Deucher,
Patrik Jakobsson
On 2021-10-27 10:39, Guenter Roeck wrote:
> On Wed, Oct 13, 2021 at 04:04:13PM -0400, Thelford Williams wrote:
>> Size can be any value and is user controlled resulting in overwriting the
>> 40 byte array wr_buf with an arbitrary length of data from buf.
>>
>> Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
>> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
>
> The fix works, but unless I am missing something it is incomplete.
> parse_write_buffer_into_params() is called several times, and the
> size parameter is always wrong. This patch only fixes one of several
> instances of the problem.
>
Patrik sent a patch that covers all cases:
https://patchwork.freedesktop.org/patch/461554/?series=96341&rev=2
Harry
> Guenter
>
>> ---
>> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
>> index 814f67d86a3c..9b3ad56607bb 100644
>> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
>> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
>> @@ -264,7 +264,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf,
>> if (!wr_buf)
>> return -ENOSPC;
>>
>> - if (parse_write_buffer_into_params(wr_buf, size,
>> + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
>> (long *)param, buf,
>> max_param_num,
>> ¶m_nums)) {
>> --
>> 2.33.0
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] drm/amdgpu: fix out of bounds write
@ 2021-10-27 14:39 Guenter Roeck
2021-10-27 15:22 ` Harry Wentland
0 siblings, 1 reply; 7+ messages in thread
From: Guenter Roeck @ 2021-10-27 14:39 UTC (permalink / raw)
To: Thelford Williams
Cc: amd-gfx, dri-devel, linux-kernel, David Airlie, Alex Deucher
On Wed, Oct 13, 2021 at 04:04:13PM -0400, Thelford Williams wrote:
> Size can be any value and is user controlled resulting in overwriting the
> 40 byte array wr_buf with an arbitrary length of data from buf.
>
> Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
The fix works, but unless I am missing something it is incomplete.
parse_write_buffer_into_params() is called several times, and the
size parameter is always wrong. This patch only fixes one of several
instances of the problem.
Guenter
> ---
> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> index 814f67d86a3c..9b3ad56607bb 100644
> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
> @@ -264,7 +264,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf,
> if (!wr_buf)
> return -ENOSPC;
>
> - if (parse_write_buffer_into_params(wr_buf, size,
> + if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
> (long *)param, buf,
> max_param_num,
> ¶m_nums)) {
> --
> 2.33.0
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2021-10-27 15:59 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-13 20:04 [PATCH] drm/amdgpu: fix out of bounds write T. Williams
2021-10-13 20:40 ` Alex Deucher
2021-10-27 10:08 ` Patrik Jakobsson
2021-10-27 13:05 ` Patrik Jakobsson
2021-10-27 14:39 Guenter Roeck
2021-10-27 15:22 ` Harry Wentland
2021-10-27 15:59 ` Guenter Roeck
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.