diff options
| author | Jeremy Cline <[email protected]> | 2021-01-11 21:05:28 +0000 |
|---|---|---|
| committer | Alex Deucher <[email protected]> | 2021-01-14 04:46:34 +0000 |
| commit | 0257b464b4d52a43cca6c8020b9586b2a6f46153 (patch) | |
| tree | d5964f13a008c06b419e05ccf11c14764825abdf /drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | |
| parent | drm/amdgpu: Decrease compute timeout to 10 s for sriov multiple VF (diff) | |
| download | kernel-0257b464b4d52a43cca6c8020b9586b2a6f46153.tar.gz kernel-0257b464b4d52a43cca6c8020b9586b2a6f46153.zip | |
drm/amdkfd: Fix out-of-bounds read in kdf_create_vcrat_image_cpu()
KASAN reported a slab-out-of-bounds read of size 1 in
kdf_create_vcrat_image_cpu().
This occurs when, for example, when on an x86_64 with a single NUMA node
because kfd_fill_iolink_info_for_cpu() is a no-op, but afterwards the
sub_type_hdr->length, which is out-of-bounds, is read and multiplied by
entries. Fortunately, entries is 0 in this case so the overall
crat_table->length is still correct.
Check if there were any entries before de-referencing sub_type_hdr which
may be pointing to out-of-bounds memory.
Fixes: b7b6c38529c9 ("drm/amdkfd: Calculate CPU VCRAT size dynamically (v2)")
Suggested-by: Felix Kuehling <[email protected]>
Signed-off-by: Jeremy Cline <[email protected]>
Reviewed-by: Felix Kuehling <[email protected]>
Signed-off-by: Felix Kuehling <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c')
0 files changed, 0 insertions, 0 deletions