Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1617951
| Path | csiph.com!1.us.feeder.erje.net!feeder.erje.net!2.eu.feeder.erje.net!border1.nntp.ams1.giganews.com!nntp.giganews.com!peer02.ams1!peer.ams1.xlned.com!news.xlned.com!newsfeed.xs4all.nl!newsfeed9.news.xs4all.nl!news.redatomik.org!aioe.org!news.servidellagleba.it!bofh.it!news.nic.it!robomod |
|---|---|
| From | Vladis Dronov <vdronov@redhat.com> |
| Newsgroups | linux.kernel |
| Subject | [PATCH v2] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() |
| Date | Thu, 06 Apr 2017 14:40:01 +0200 |
| Message-ID | <tteRH-5K-13@gated-at.bofh.it> (permalink) |
| X-Original-To | VMware Graphics <linux-graphics-maintainer@vmware.com>, Sinclair Yeh <syeh@vmware.com>, Thomas Hellstrom <thellstrom@vmware.com>, David Airlie <airlied@linux.ie>, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org |
| Dmarc-Filter | OpenDMARC Filter v1.3.2 mx1.redhat.com A35B5C04B956 |
| Authentication-Results | ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com |
| Authentication-Results | ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=vdronov@redhat.com |
| Dkim-Filter | OpenDKIM Filter v2.11.0 mx1.redhat.com A35B5C04B956 |
| X-Scanned-By | MIMEDefang 2.79 on 10.5.11.15 |
| X-Greylist | Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Thu, 06 Apr 2017 12:33:46 +0000 (UTC) |
| Sender | robomod@news.nic.it |
| List-ID | <linux-kernel.vger.kernel.org> |
| X-Mailing-List | linux-kernel@vger.kernel.org |
| Approved | robomod@news.nic.it |
| Lines | 27 |
| Organization | linux.* mail to news gateway |
| X-Original-Cc | Vladis Dronov <vdronov@redhat.com> |
| X-Original-Date | Thu, 6 Apr 2017 14:33:40 +0200 |
| X-Original-Message-ID | <20170406123340.5368-1-vdronov@redhat.com> |
| X-Original-Sender | linux-kernel-owner@vger.kernel.org |
| X-Received-Body-CRC | 2937985312 |
| Xref | csiph.com linux.kernel:1617951 |
Show key headers only | View raw
The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is a user-controlled 'uint32_t' value which is used as a loop count limit. This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'. References: https://bugzilla.redhat.com/show_bug.cgi?id=1437431 Signed-off-by: Vladis Dronov <vdronov@redhat.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index b445ce9..e0d7ff9 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -1281,6 +1281,9 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, if (req->multisample_count != 0) return -EINVAL; + if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS) + return -EINVAL; + if (unlikely(vmw_user_surface_size == 0)) vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) + 128; -- 2.9.3
Back to linux.kernel | Previous | Next | Find similar | Unroll thread
[PATCH v2] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() Vladis Dronov <vdronov@redhat.com> - 2017-04-06 14:40 +0200
csiph-web