kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/gpu
History
Li Qiang 2e29dce3fd drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() 
commit e7e11f9956 upstream.

In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the
'req->mip_levels' array. This array can be assigned any value from
the user space. As both the 'num_sizes' and the array is uint32_t,
it is easy to make 'num_sizes' overflow. The later 'mip_levels' is
used as the loop count. This can lead an oob write. Add the check of
'req->mip_levels' to avoid this.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-04-22 07:14:59 +02:00
..
drm drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() 2017-04-22 07:14:59 +02:00
host1x drm/tegra: Make job submission 64-bit safe 2014-08-04 10:07:36 +02:00
ipu-v3 IPUv3 fixes for v3.18 2014-10-07 14:31:14 +10:00
vga Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2014-10-13 16:23:15 +02:00
Makefile gpu: ipu-v3: Move i.MX IPUv3 core driver out of staging 2014-06-04 11:06:52 +02:00