Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1655343
| Path | csiph.com!eternal-september.org!feeder.eternal-september.org!news.unit0.net!news.panservice.it!bofh.it!news.nic.it!robomod |
|---|---|
| From | Ben Hutchings <ben@decadent.org.uk> |
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.16 188/212] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() |
| Date | Thu, 01 Jun 2017 18:10:04 +0200 |
| Message-ID | <tNAPG-4Ly-55@gated-at.bofh.it> (permalink) |
| References | <tNAwh-4oP-3@gated-at.bofh.it> |
| X-Original-To | linux-kernel@vger.kernel.org, stable@vger.kernel.org |
| Content-Type | text/plain; charset="UTF-8" |
| Content-Disposition | inline |
| Content-Transfer-Encoding | 8bit |
| MIME-Version | 1.0 |
| X-Mailer | LinuxStableQueue (scripts by bwh) |
| X-Sa-Exim-Connect-IP | 82.70.136.246 |
| X-Sa-Exim-Mail-From | ben@decadent.org.uk |
| X-Sa-Exim-Scanned | No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 34 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | akpm@linux-foundation.org, "Murray McAllister" <murray.mcallister@insomniasec.com>, "Sinclair Yeh" <syeh@vmware.com> |
| X-Original-Date | Thu, 01 Jun 2017 16:43:16 +0100 |
| X-Original-Message-ID | <lsq.1496331796.368115055@decadent.org.uk> |
| X-Original-References | <lsq.1496331794.574686034@decadent.org.uk> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| Xref | csiph.com linux.kernel:1655343 |
Show key headers only | View raw
3.16.44-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Murray McAllister <murray.mcallister@insomniasec.com> commit 36274ab8c596f1240c606bb514da329add2a1bcd upstream. Before memory allocations vmw_surface_define_ioctl() checks the upper-bounds of a user-supplied size, but does not check if the supplied size is 0. Add check to avoid NULL pointer dereferences. Signed-off-by: Murray McAllister <murray.mcallister@insomniasec.com> Reviewed-by: Sinclair Yeh <syeh@vmware.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -714,8 +714,8 @@ int vmw_surface_define_ioctl(struct drm_ for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) num_sizes += req->mip_levels[i]; - if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * - DRM_VMW_MAX_MIP_LEVELS) + if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS || + num_sizes == 0) return -EINVAL; size = vmw_user_surface_size + 128 +
Back to linux.kernel | Previous | Next | Find similar | Unroll thread
[PATCH 3.16 188/212] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Ben Hutchings <ben@decadent.org.uk> - 2017-06-01 18:10 +0200
csiph-web