This is a note to let you know that I've just added the patch titled
drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
drm-amdgpu-fix-possible-uaf-in-amdgpu_cs_pass1.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 90e065677e0362a777b9db97ea21d43a39211399 Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexander.deucher@xxxxxxx>
Date: Fri, 28 Jul 2023 11:14:05 -0400
Subject: drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: Alex Deucher <alexander.deucher@xxxxxxx>
commit 90e065677e0362a777b9db97ea21d43a39211399 upstream.
Since the gang_size check is outside of chunk parsing
loop, we need to reset i before we free the chunk data.
Suggested by Ye Zhang (@VAR10CK) of Baidu Security.
Reviewed-by: Guchun Chen <guchun.chen@xxxxxxx>
Reviewed-by: Christian König <christian.koenig@xxxxxxx>
Signed-off-by: Alex Deucher <alexander.deucher@xxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
@@ -287,7 +287,7 @@ static int amdgpu_cs_pass1(struct amdgpu
if (!p->gang_size) {
ret = -EINVAL;
- goto free_partial_kdata;
+ goto free_all_kdata;
}
for (i = 0; i < p->gang_size; ++i) {
Patches currently in stable-queue which might be from alexander.deucher@xxxxxxx are
queue-6.1/drm-amd-disable-s-g-for-apus-when-64gb-or-more-host-memory.patch
queue-6.1/drm-amdgpu-add-s-g-display-parameter.patch
queue-6.1/drm-amd-display-check-attr-flag-before-set-cursor-degamma-on-dcn3.patch
queue-6.1/drm-amdgpu-fix-possible-uaf-in-amdgpu_cs_pass1.patch
queue-6.1/drm-amd-display-limit-dpia-link-rate-to-hbr3.patch
