From 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96 Mon Sep 17 00:00:00 2001

From: Colin Ian King <colin.king@canonical.com>

Date: Wed, 3 Mar 2021 00:27:59 +0000

Subject: [PATCH] drm/radeon: fix copy of uninitialized variable back to userspace

Mime-version: 1.0

Content-type: text/plain; charset=UTF-8

Content-transfer-encoding: 8bit

Git-commit: 8dbc2ccac5a65c5b57e3070e36a3dc97c7970d96

Patch-mainline: v5.13-rc1

References: git-fixes

Currently the ioctl command RADEON_INFO_SI_BACKEND_ENABLED_MASK can

copy back uninitialised data in value_tmp that pointer *value points

to. This can occur when rdev->family is less than CHIP_BONAIRE and

less than CHIP_TAHITI.  Fix this by adding in a missing -EINVAL

so that no invalid value is copied back to userspace.

Addresses-coverity: ("Uninitialized scalar variable)

Cc: stable@vger.kernel.org # 3.13+

Fixes: 439a1cfffe2c ("drm/radeon: expose render backend mask to the userspace")

Reviewed-by: Christian König <christian.koenig@amd.com>

Signed-off-by: Colin Ian King <colin.king@canonical.com>

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 drivers/gpu/drm/radeon/radeon_kms.c | 1 +

 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c

index 2479d6ab7a36..58876bb4ef2a 100644

--- a/drivers/gpu/drm/radeon/radeon_kms.c

+++ b/drivers/gpu/drm/radeon/radeon_kms.c

@@ -518,6 +518,7 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)

 			*value = rdev->config.si.backend_enable_mask;

 		} else {

 			DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n");

+			return -EINVAL;

 		}

 		break;

 	case RADEON_INFO_MAX_SCLK:

-- 

2.26.2