[PATCH] drm/amdgpu: fix a potential information leaking bug

[Christian König]

Am 27.07.19 um 11:37 schrieb Chunming Zhou:
> 在 2019/7/27 17:30, Wang Xiayang 写道:
>> Coccinelle reports a path that the array "data" is never initialized.
>> The path skips the checks in the conditional branches when either
>> of callback functions, read_wave_vgprs and read_wave_sgprs, is not
>> registered. Later, the uninitialized "data" array is read
>> in the while-loop below and passed to put_user().
>>
>> Fix the path by allocating the array with kcalloc().
>>
>> The patch is simplier than adding a fall-back branch that explicitly
>> calls memset(data, 0, ...). Also it does not need the multiplication
>> 1024*sizeof(*data) as the size parameter for memset() though there is
>> no risk of integer overflow.
>>
>> Signed-off-by: Wang Xiayang <xywang.sjtu at sjtu.edu.cn>
> Reviewed-by: Chunming Zhou <david1.zhou at amd.com>

Picked that up, reviewed it and pushed it into our internal branch.

Christian.

>
> -David
>
>> ---
>>    drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +-
>>    1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
>> index 6d54decef7f8..5652cc72ed3a 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
>> @@ -707,7 +707,7 @@ static ssize_t amdgpu_debugfs_gpr_read(struct file *f, char __user *buf,
>>    	thread = (*pos & GENMASK_ULL(59, 52)) >> 52;
>>    	bank = (*pos & GENMASK_ULL(61, 60)) >> 60;
>>    
>> -	data = kmalloc_array(1024, sizeof(*data), GFP_KERNEL);
>> +	data = kcalloc(1024, sizeof(*data), GFP_KERNEL);
>>    	if (!data)
>>    		return -ENOMEM;
>>    
> _______________________________________________
> amd-gfx mailing list
> amd-gfx at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx