| From 2ddca328d6f3ad174cc0f8e4b6b47a3c062871fa Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 17 Oct 2019 23:29:53 -0500 |
| Subject: gma/gma500: fix a memory disclosure bug due to uninitialized bytes |
| |
| From: Kangjie Lu <kjlu@umn.edu> |
| |
| [ Upstream commit 57a25a5f754ce27da2cfa6f413cfd366f878db76 ] |
| |
| `best_clock` is an object that may be sent out. Object `clock` |
| contains uninitialized bytes that are copied to `best_clock`, |
| which leads to memory disclosure and information leak. |
| |
| Signed-off-by: Kangjie Lu <kjlu@umn.edu> |
| Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> |
| Link: https://patchwork.freedesktop.org/patch/msgid/20191018042953.31099-1-kjlu@umn.edu |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/gpu/drm/gma500/cdv_intel_display.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/drivers/gpu/drm/gma500/cdv_intel_display.c b/drivers/gpu/drm/gma500/cdv_intel_display.c |
| index 7d47b3d5cc0d0..54d554d720004 100644 |
| --- a/drivers/gpu/drm/gma500/cdv_intel_display.c |
| +++ b/drivers/gpu/drm/gma500/cdv_intel_display.c |
| @@ -415,6 +415,8 @@ static bool cdv_intel_find_dp_pll(const struct gma_limit_t *limit, |
| struct gma_crtc *gma_crtc = to_gma_crtc(crtc); |
| struct gma_clock_t clock; |
| |
| + memset(&clock, 0, sizeof(clock)); |
| + |
| switch (refclk) { |
| case 27000: |
| if (target < 200000) { |
| -- |
| 2.25.1 |
| |
