CVE-2021-47535

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/a6xx: Allocate enough space for GMU registers

In commit 142639a52a01 ("drm/msm/a6xx: fix crashstate capture for

A650") we changed a6xx_get_gmu_registers() to read 3 sets of

registers. Unfortunately, we didn't change the memory allocation for

the array. That leads to a KASAN warning (this was on the chromeos-5.4

kernel, which has the problematic commit backported to it):

BUG: KASAN: slab-out-of-bounds in _a6xx_get_gmu_registers+0x144/0x430

Write of size 8 at addr ffffff80c89432b0 by task A618-worker/209

CPU: 5 PID: 209 Comm: A618-worker Tainted: G W 5.4.156-lockdep #22

Hardware name: Google Lazor Limozeen without Touchscreen (rev5 - rev8) (DT)

Call trace:

dump_backtrace+0x0/0x248

show_stack+0x20/0x2c

dump_stack+0x128/0x1ec

print_address_description+0x88/0x4a0

__kasan_report+0xfc/0x120

kasan_report+0x10/0x18

__asan_report_store8_noabort+0x1c/0x24

_a6xx_get_gmu_r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References