<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <b class="gmail_sendername" dir="auto">docfate111</b> <span dir="auto"><<a href="mailto:tdwilliamsiv@gmail.com">tdwilliamsiv@gmail.com</a>></span><br>Date: Mon, Oct 11, 2021 at 4:22 PM<br>Subject: [PATCH] Size can be any value and is user controlled resulting in overwriting the 40 byte array wr_buf with an arbitrary length of data from buf.<br>To:  <<a href="mailto:dri-devel@lists.freedesktop.org">dri-devel@lists.freedesktop.org</a>><br>Cc:  <<a href="mailto:harry.wentland@amd.com">harry.wentland@amd.com</a>>,  <<a href="mailto:sunpeng.li@amd.com">sunpeng.li@amd.com</a>><br></div><br><br>Signed-off-by: docfate111 <<a href="mailto:tdwilliamsiv@gmail.com" target="_blank">tdwilliamsiv@gmail.com</a>><br>
---<br>
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-<br>
 1 file changed, 1 insertion(+), 1 deletion(-)<br>
<br>
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c<br>
index 87daa78a32b8..17f2756a64dc 100644<br>
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c<br>
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c<br>
@@ -263,7 +263,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf,<br>
        if (!wr_buf)<br>
                return -ENOSPC;<br>
<br>
-       if (parse_write_buffer_into_params(wr_buf, size,<br>
+       if (parse_write_buffer_into_params(wr_buf, wr_buf_size,<br>
                                           (long *)param, buf,<br>
                                           max_param_num,<br>
                                           &param_nums)) {<br>
-- <br>
2.25.1<br>
<br>
</div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Thank you for your time,<br></div>Thelford Williams<br></div></div></div>