Description
In the Linux kernel, the following vulnerability has been resolved: drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() msm_ioctl_gem_info_get_metadata() always returns 0 regardless of errors. When copy_to_user() fails or the user buffer is too small, the error code stored in ret is ignored because the function unconditionally returns 0. This causes userspace to believe the ioctl succeeded when it did not. Additionally, kmemdup() can return NULL on allocation failure, but the return value is not checked. This leads to a NULL pointer dereference in the subsequent copy_to_user() call. Add the missing NULL check for kmemdup() and return ret instead of 0. Note that the SET counterpart (msm_ioctl_gem_info_set_metadata) correctly returns ret. Patchwork: https://patchwork.freedesktop.org/patch/714478/
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9902cb999e4e913d98e8afe4b36c08e4a793e1ce to < 697e1a9559f6962f999cc4c748c2ffffcc0a7a7aaffected9902cb999e4e913d98e8afe4b36c08e4a793e1ce to < c57c861956b89f2e2528e6384d51e2dedd915809affected9902cb999e4e913d98e8afe4b36c08e4a793e1ce to < b079e85c91f446f29e808d8291189e897f1884ffaffected9902cb999e4e913d98e8afe4b36c08e4a793e1ce to < 47cbfe2608314b833ad61a65827d8fb363bc2d2daffected
Linux Linux
Default version status: affected
6.8affected0 to < 6.8unaffected6.12.90 to ≤ 6.12.*unaffected6.18.32 to ≤ 6.18.*unaffected7.0.9 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected