mirror of
https://github.com/torvalds/linux.git
synced 2026-10-30 14:06:03 +01:00
4e1a53892b
virtio_get_edid_block() validates the read offset only against the
device-supplied resp->size field, never against the fixed-size resp->edid
array. The EDID block index is driven by the device-supplied extension
count, so a malicious virtio-gpu backend can advertise a large size
together with a high block count and read far past the array into adjacent
kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds
read / info leak).
Also reject any read whose end exceeds the size of the edid array.
Conforming EDID responses stay within the array and are unaffected.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| virtgpu_debugfs.c | ||
| virtgpu_display.c | ||
| virtgpu_drv.c | ||
| virtgpu_drv.h | ||
| virtgpu_fence.c | ||
| virtgpu_gem.c | ||
| virtgpu_ioctl.c | ||
| virtgpu_kms.c | ||
| virtgpu_object.c | ||
| virtgpu_plane.c | ||
| virtgpu_prime.c | ||
| virtgpu_submit.c | ||
| virtgpu_trace_points.c | ||
| virtgpu_trace.h | ||
| virtgpu_vq.c | ||
| virtgpu_vram.c | ||