Dan Carpenter 0913eab648 drm/amdgpu: info leak in amdgpu_gem_metadata_ioctl() ...

There is no limit on args->data.data_size_bytes so we could read beyond
the end of the args->data.data[] array.

Reviewed-by: Christian König <christian.koenig@amd.com>
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

2015-09-23 17:23:44 -04:00

18 KiB

Raw Blame History

View Raw