From: Patrik Jakobsson patrik.r.jakobsson@gmail.com
[ Upstream commit 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 ]
CVE-2021-42327 was fixed by:
commit f23750b5b3d98653b31d4469592935ef6364ad67 Author: Thelford Williams tdwilliamsiv@gmail.com Date: Wed Oct 13 16:04:13 2021 -0400
drm/amdgpu: fix out of bounds write
but amdgpu_dm_debugfs.c contains more of the same issue so fix the remaining ones.
v2: * Add missing fix in dp_max_bpc_write (Harry Wentland)
Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated") Signed-off-by: Patrik Jakobsson pjakobsson@suse.de Reviewed-by: Harry Wentland harry.wentland@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Cc: stable@vger.kernel.org [ Cherry-pick the fix and drop the following functions which were introduced since 5.13 or later: dp_max_bpc_write() was introduced in commit cca912e0a6b4 ("drm/amd/display: Add max bpc debugfs") dp_dsc_passthrough_set() was introduced in commit fcd1e484c8ae ("drm/amd/display: Add debugfs entry for dsc passthrough").] Signed-off-by: Xiangyu Chen xiangyu.chen@windriver.com Signed-off-by: He Zhe zhe.he@windriver.com --- Verified the build test. --- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index 32dbd2a27088..6914738f0275 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -424,7 +424,7 @@ static ssize_t dp_phy_settings_write(struct file *f, const char __user *buf, if (!wr_buf) return -ENOSPC;
- if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) { @@ -576,7 +576,7 @@ static ssize_t dp_phy_test_pattern_debugfs_write(struct file *f, const char __us if (!wr_buf) return -ENOSPC;
- if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) { @@ -1091,7 +1091,7 @@ static ssize_t dp_trigger_hotplug(struct file *f, const char __user *buf, return -ENOSPC; }
- if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) { @@ -1272,7 +1272,7 @@ static ssize_t dp_dsc_clock_en_write(struct file *f, const char __user *buf, return -ENOSPC; }
- if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) { @@ -1426,7 +1426,7 @@ static ssize_t dp_dsc_slice_width_write(struct file *f, const char __user *buf, return -ENOSPC; }
- if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) { @@ -1580,7 +1580,7 @@ static ssize_t dp_dsc_slice_height_write(struct file *f, const char __user *buf, return -ENOSPC; }
- if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) { @@ -1727,7 +1727,7 @@ static ssize_t dp_dsc_bits_per_pixel_write(struct file *f, const char __user *bu return -ENOSPC; }
- if (parse_write_buffer_into_params(wr_buf, size, + if (parse_write_buffer_into_params(wr_buf, wr_buf_size, (long *)param, buf, max_param_num, ¶m_nums)) {
[ Sasha's backport helper bot ]
Hi,
✅ All tests passed successfully. No issues detected. No action required from the submitter.
The upstream commit SHA1 provided is correct: 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5
WARNING: Author mismatch between patch and upstream commit: Backport author: Xiangyu Chenxiangyu.chen@eng.windriver.com Commit author: Patrik Jakobssonpatrik.r.jakobsson@gmail.com
Status in newer kernel trees: 6.13.y | Present (exact SHA1) 6.12.y | Present (exact SHA1) 6.6.y | Present (exact SHA1) 6.1.y | Present (exact SHA1) 5.15.y | Present (exact SHA1)
Note: The patch differs from the upstream commit: --- 1: 3f4e54bd312d3 ! 1: 8c3a806d075d2 drm/amdgpu: Fix even more out of bound writes from debugfs @@ Metadata ## Commit message ## drm/amdgpu: Fix even more out of bound writes from debugfs
+ [ Upstream commit 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 ] + CVE-2021-42327 was fixed by:
commit f23750b5b3d98653b31d4469592935ef6364ad67 @@ Commit message Reviewed-by: Harry Wentland harry.wentland@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Cc: stable@vger.kernel.org + [ Cherry-pick the fix and drop the following functions which were introduced since 5.13 or later: + dp_max_bpc_write() was introduced in commit cca912e0a6b4 ("drm/amd/display: Add max bpc debugfs") + dp_dsc_passthrough_set() was introduced in commit fcd1e484c8ae + ("drm/amd/display: Add debugfs entry for dsc passthrough").] + Signed-off-by: Xiangyu Chen xiangyu.chen@windriver.com + Signed-off-by: He Zhe zhe.he@windriver.com
## drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c ## @@ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c: static ssize_t dp_phy_settings_write(struct file *f, const char __user *buf, @@ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c: static ssize_t dp_phy (long *)param, buf, max_param_num, ¶m_nums)) { -@@ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c: static ssize_t dp_dsc_passthrough_set(struct file *f, const char __user *buf, - return -ENOSPC; - } - -- if (parse_write_buffer_into_params(wr_buf, size, -+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, - ¶m, buf, - max_param_num, - ¶m_nums)) { -@@ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c: static ssize_t trigger_hotplug(struct file *f, const char __user *buf, +@@ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c: static ssize_t dp_trigger_hotplug(struct file *f, const char __user *buf, return -ENOSPC; }
@@ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c: static ssize_t dp_dsc (long *)param, buf, max_param_num, ¶m_nums)) { -@@ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c: static ssize_t dp_max_bpc_write(struct file *f, const char __user *buf, - return -ENOSPC; - } - -- if (parse_write_buffer_into_params(wr_buf, size, -+ if (parse_write_buffer_into_params(wr_buf, wr_buf_size, - (long *)param, buf, - max_param_num, - ¶m_nums)) { ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.10.y | Success | Success |
linux-stable-mirror@lists.linaro.org
-
Sasha Levin -
Xiangyu Chen