Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c7ba3653e9773256b2b08508a2ed2ca28ea7566b to < ee9cfcf77a8e8af637396dc00966df5f701e661caffectedc7ba3653e9773256b2b08508a2ed2ca28ea7566b to < b781f90a9528555c709e59789550893581ef0be4affectedc7ba3653e9773256b2b08508a2ed2ca28ea7566b to < a2de1d71891a038a9346b2c1a72b88c8350f2479affectedc7ba3653e9773256b2b08508a2ed2ca28ea7566b to < 7fc4fab4acc307ad2903312c195872b2953d32c3affectedc7ba3653e9773256b2b08508a2ed2ca28ea7566b to < 7ae95c0275c330b5dbae806f8e431720edad776faffectedc7ba3653e9773256b2b08508a2ed2ca28ea7566b to < bb6f705b73b5f191f14ad004e2c8c4b615806187affectedc7ba3653e9773256b2b08508a2ed2ca28ea7566b to < c90954cdea4d6998ec345de0d840d030c145b89eaffectedc7ba3653e9773256b2b08508a2ed2ca28ea7566b to < adf67034b1f61f7119295208085bfd43f85f56afaffected
Linux Linux
Default version status: affected
5.2affected0 to < 5.2unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.94 to ≤ 6.12.*unaffected6.18.36 to ≤ 6.18.*unaffected7.0.13 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ee9cfcf77a8e8af637396dc00966df5f701e661c ↗
- https://git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4 ↗
- https://git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479 ↗
- https://git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3 ↗
- https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f ↗
- https://git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187 ↗
- https://git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e ↗
- https://git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af ↗