Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1617951

[PATCH v2] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

Path csiph.com!1.us.feeder.erje.net!feeder.erje.net!2.eu.feeder.erje.net!border1.nntp.ams1.giganews.com!nntp.giganews.com!peer02.ams1!peer.ams1.xlned.com!news.xlned.com!newsfeed.xs4all.nl!newsfeed9.news.xs4all.nl!news.redatomik.org!aioe.org!news.servidellagleba.it!bofh.it!news.nic.it!robomod
From Vladis Dronov <vdronov@redhat.com>
Newsgroups linux.kernel
Subject [PATCH v2] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()
Date Thu, 06 Apr 2017 14:40:01 +0200
Message-ID <tteRH-5K-13@gated-at.bofh.it> (permalink)
X-Original-To VMware Graphics <linux-graphics-maintainer@vmware.com>, Sinclair Yeh <syeh@vmware.com>, Thomas Hellstrom <thellstrom@vmware.com>, David Airlie <airlied@linux.ie>, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Dmarc-Filter OpenDMARC Filter v1.3.2 mx1.redhat.com A35B5C04B956
Authentication-Results ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com
Authentication-Results ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=vdronov@redhat.com
Dkim-Filter OpenDKIM Filter v2.11.0 mx1.redhat.com A35B5C04B956
X-Scanned-By MIMEDefang 2.79 on 10.5.11.15
X-Greylist Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Thu, 06 Apr 2017 12:33:46 +0000 (UTC)
Sender robomod@news.nic.it
List-ID <linux-kernel.vger.kernel.org>
X-Mailing-List linux-kernel@vger.kernel.org
Approved robomod@news.nic.it
Lines 27
Organization linux.* mail to news gateway
X-Original-Cc Vladis Dronov <vdronov@redhat.com>
X-Original-Date Thu, 6 Apr 2017 14:33:40 +0200
X-Original-Message-ID <20170406123340.5368-1-vdronov@redhat.com>
X-Original-Sender linux-kernel-owner@vger.kernel.org
X-Received-Body-CRC 2937985312
Xref csiph.com linux.kernel:1617951

Show key headers only | View raw


The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is
a user-controlled 'uint32_t' value which is used as a loop count limit.
This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1437431
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index b445ce9..e0d7ff9 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -1281,6 +1281,9 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
 	if (req->multisample_count != 0)
 		return -EINVAL;
 
+	if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS)
+		return -EINVAL;
+
 	if (unlikely(vmw_user_surface_size == 0))
 		vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) +
 			128;
-- 
2.9.3

Back to linux.kernel | Previous | Next | Find similar | Unroll thread


Thread

[PATCH v2] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() Vladis Dronov <vdronov@redhat.com> - 2017-04-06 14:40 +0200

csiph-web