drm/amdgpu: fix a potential information leaking bug
authorWang Xiayang <xywang.sjtu@sjtu.edu.cn>
Sat, 27 Jul 2019 09:30:30 +0000 (17:30 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 25 Aug 2019 08:47:55 +0000 (10:47 +0200)
commit68340db992f6704b86a27e3f9f91d44ce1c8cb31
tree34adcf8f0f9b9a494031971836e438bbaf099c1b
parent02d4fe0193d569ecce9dfa9e45b10f98521df472
drm/amdgpu: fix a potential information leaking bug

[ Upstream commit 929e571c04c285861e0bb049a396a2bdaea63282 ]

Coccinelle reports a path that the array "data" is never initialized.
The path skips the checks in the conditional branches when either
of callback functions, read_wave_vgprs and read_wave_sgprs, is not
registered. Later, the uninitialized "data" array is read
in the while-loop below and passed to put_user().

Fix the path by allocating the array with kcalloc().

The patch is simplier than adding a fall-back branch that explicitly
calls memset(data, 0, ...). Also it does not need the multiplication
1024*sizeof(*data) as the size parameter for memset() though there is
no risk of integer overflow.

Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
Reviewed-by: Chunming Zhou <david1.zhou@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c