]> git.baikalelectronics.ru Git - kernel.git/commit
drm/amdgpu: Fix a buffer overflow handling the serial number
authorDan Carpenter <dan.carpenter@oracle.com>
Wed, 10 Jun 2020 08:56:53 +0000 (11:56 +0300)
committerAlex Deucher <alexander.deucher@amd.com>
Wed, 1 Jul 2020 05:59:19 +0000 (01:59 -0400)
commit3bde6ae7bec00143e860520c8f546cc2c2fb37d0
tree916d6d101740090bd915bbaacdd753b31fafc63a
parent227793fd14379d93fa773d3222235bb5ce1f4e10
drm/amdgpu: Fix a buffer overflow handling the serial number

The comments say that the serial number is a 16-digit HEX string so the
buffer needs to be at least 17 characters to hold the NUL terminator.

The other issue is that "size" returned from sprintf() is the number of
characters before the NUL terminator so the memcpy() wasn't copying the
terminator.  The serial number needs to be NUL terminated so that it
doesn't lead to a read overflow in amdgpu_device_get_serial_number().
Also it's just cleaner and faster to sprintf() directly to adev->serial[]
instead of using a temporary buffer.

Fixes: 5c44e7a9dcc7 ("drm/amdgpu: Add unique_id and serial_number for Arcturus v3")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Evan Quan <evan.quan@amd.com>
drivers/gpu/drm/amd/amdgpu/amdgpu.h
drivers/gpu/drm/amd/powerplay/arcturus_ppt.c