drm/amdgpu: info leak in amdgpu_gem_metadata_ioctl()
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 23 Sep 2015 11:00:35 +0000 (14:00 +0300)
committerAlex Deucher <alexander.deucher@amd.com>
Wed, 23 Sep 2015 21:23:44 +0000 (17:23 -0400)
commit0913eab648e4fb30ddca8882e707d0fcf5b237c6
tree7530627890f1194b61d0e8ba57eefcc5e42ab59d
parent0d2edd3791bb172a59d708d5c94330bbd6050f97
drm/amdgpu: info leak in amdgpu_gem_metadata_ioctl()

There is no limit on args->data.data_size_bytes so we could read beyond
the end of the args->data.data[] array.

Reviewed-by: Christian König <christian.koenig@amd.com>
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c