Christian König 96800ba9e5 drm/ttm: fix out-of-bounds read in ttm_put_pages() v2 ...

commit a66477b0ef upstream.

When ttm_put_pages() tries to figure out whether it's dealing with
transparent hugepages, it just reads past the bounds of the pages array
without a check.

v2: simplify the test if enough pages are left in the array (Christian).

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Christian König <christian.koenig@amd.com>
Fixes: 5c42c64f7d ("drm/ttm: fix the fix for huge compound pages")
Cc: stable@vger.kernel.org
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
Reviewed-by: Huang Rui <ray.huang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-04-27 09:36:37 +02:00

..

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ttm_agp_backend.c

Add SPDX idenitifier and clarify license

2018-05-15 13:44:27 -05:00

ttm_bo_manager.c

Add SPDX idenitifier and clarify license

2018-05-15 13:44:27 -05:00

ttm_bo_util.c

drm/ttm: fix LRU handling in ttm_buffer_object_transfer

2018-12-21 14:15:15 +01:00

ttm_bo_vm.c

drm/ttm: Replace ttm_bo_unref() with ttm_bo_put()

2018-07-10 14:18:28 -05:00

ttm_bo.c

drm/ttm: Fix bo_global and mem_global kfree error

2019-04-20 09:16:02 +02:00

ttm_execbuf_util.c

Add SPDX idenitifier and clarify license

2018-05-15 13:44:27 -05:00

ttm_lock.c

Add SPDX idenitifier and clarify license

2018-05-15 13:44:27 -05:00

ttm_memory.c

drm/ttm: Fix bo_global and mem_global kfree error

2019-04-20 09:16:02 +02:00

ttm_module.c

Add SPDX idenitifier and clarify license

2018-05-15 13:44:27 -05:00

ttm_object.c

Add SPDX idenitifier and clarify license

2018-05-15 13:44:27 -05:00

ttm_page_alloc_dma.c

drm/ttm: fix missed conversion of set_pages_array_uc

2018-08-01 17:22:20 -05:00

ttm_page_alloc.c

drm/ttm: fix out-of-bounds read in ttm_put_pages() v2

2019-04-27 09:36:37 +02:00

ttm_tt.c

drm/ttm: clean up non-x86 definitions on ttm_tt

2018-08-01 17:23:56 -05:00