CVE-2021-47535

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/msm/a6xx: Allocate enough space for GMU registers<br /> <br /> In commit 142639a52a01 ("drm/msm/a6xx: fix crashstate capture for<br /> A650") we changed a6xx_get_gmu_registers() to read 3 sets of<br /> registers. Unfortunately, we didn&amp;#39;t change the memory allocation for<br /> the array. That leads to a KASAN warning (this was on the chromeos-5.4<br /> kernel, which has the problematic commit backported to it):<br /> <br /> BUG: KASAN: slab-out-of-bounds in _a6xx_get_gmu_registers+0x144/0x430<br /> Write of size 8 at addr ffffff80c89432b0 by task A618-worker/209<br /> CPU: 5 PID: 209 Comm: A618-worker Tainted: G W 5.4.156-lockdep #22<br /> Hardware name: Google Lazor Limozeen without Touchscreen (rev5 - rev8) (DT)<br /> Call trace:<br /> dump_backtrace+0x0/0x248<br /> show_stack+0x20/0x2c<br /> dump_stack+0x128/0x1ec<br /> print_address_description+0x88/0x4a0<br /> __kasan_report+0xfc/0x120<br /> kasan_report+0x10/0x18<br /> __asan_report_store8_noabort+0x1c/0x24<br /> _a6xx_get_gmu_registers+0x144/0x430<br /> a6xx_gpu_state_get+0x330/0x25d4<br /> msm_gpu_crashstate_capture+0xa0/0x84c<br /> recover_worker+0x328/0x838<br /> kthread_worker_fn+0x32c/0x574<br /> kthread+0x2dc/0x39c<br /> ret_from_fork+0x10/0x18<br /> <br /> Allocated by task 209:<br /> __kasan_kmalloc+0xfc/0x1c4<br /> kasan_kmalloc+0xc/0x14<br /> kmem_cache_alloc_trace+0x1f0/0x2a0<br /> a6xx_gpu_state_get+0x164/0x25d4<br /> msm_gpu_crashstate_capture+0xa0/0x84c<br /> recover_worker+0x328/0x838<br /> kthread_worker_fn+0x32c/0x574<br /> kthread+0x2dc/0x39c<br /> ret_from_fork+0x10/0x18