p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
linux_old1/drivers/gpu/drm/vmwgfx
History
Li Qiang e7e11f9956 drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() 
In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the
'req->mip_levels' array. This array can be assigned any value from
the user space. As both the 'num_sizes' and the array is uint32_t,
it is easy to make 'num_sizes' overflow. The later 'mip_levels' is
used as the loop count. This can lead an oob write. Add the check of
'req->mip_levels' to avoid this.

Cc: <stable@vger.kernel.org>
Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
 		2017-03-30 11:46:26 +02:00
..
device_include drm/vmwgfx: Clear an uninitialized struct member 2017-01-26 20:52:36 -08:00
Kconfig drm: fix compilations issues introduced by "drm: allow to use mmuless SoC" 2017-01-09 11:30:30 +01:00
Makefile drm/vmwgfx: Report vmwgfx version to vmware.log 2016-05-20 17:40:07 +02:00
vmwgfx_binding.c drm/vmwgfx: Initial DX support 2015-08-12 10:06:32 -07:00
vmwgfx_binding.h drm/vmwgfx: Initial DX support 2015-08-12 10:06:32 -07:00
vmwgfx_buffer.c Merge branch 'drm-vmwgfx-next' of git://people.freedesktop.org/~syeh/repos_linux into drm-next 2017-02-01 08:40:13 +10:00
vmwgfx_cmdbuf.c drm: Improve drm_mm search (and fix topdown allocation) with rbtrees 2017-02-03 11:10:32 +01:00
vmwgfx_cmdbuf_res.c drm/vmwgfx: Fix copyright headers 2015-08-12 10:06:56 -07:00
vmwgfx_context.c Merge branch 'vmwgfx-next' of git://people.freedesktop.org/~thomash/linux into drm-next 2015-08-17 16:03:48 +10:00
vmwgfx_cotable.c drm/ttm: remove lazy parameter from ttm_bo_wait 2016-05-04 20:21:26 -04:00
vmwgfx_dmabuf.c drm/vmwgfx: Check pin count before attempting to move a buffer 2016-07-01 10:47:50 -07:00
vmwgfx_drv.c drm/vmwgfx: Work around drm removal of control nodes 2017-02-26 22:52:28 +01:00
vmwgfx_drv.h drm/vmwgfx: Work around drm removal of control nodes 2017-02-26 22:52:28 +01:00
vmwgfx_execbuf.c drm/vmwgfx: Avoid validating views on view destruction 2016-10-10 11:15:05 -07:00
vmwgfx_fb.c drm/vmwgfx: Fix depth input into drm_mode_legacy_fb_format 2017-01-26 20:52:54 -08:00
vmwgfx_fence.c drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces 2017-03-30 11:43:39 +02:00
vmwgfx_fence.h dma-buf: Rename struct fence to dma_fence 2016-10-25 14:40:39 +02:00
vmwgfx_fifo.c drm/vmwgfx: fix a warning message 2015-11-26 17:40:00 +01:00
vmwgfx_gmr.c drm/vmwgfx: Fix copyright headers 2015-08-12 10:06:56 -07:00
vmwgfx_gmrid_manager.c drm/vmwgfx: use designated initializers 2016-12-18 14:48:26 +01:00
vmwgfx_ioctl.c drm/vmwgfx: Remove getparam error message 2017-03-30 11:43:40 +02:00
vmwgfx_irq.c drm/vmwgfx: Relax irq locking somewhat 2015-11-06 16:15:40 +01:00
vmwgfx_kms.c drm/vmwgfx: Fix a potential integer overflow 2017-01-26 20:52:51 -08:00
vmwgfx_kms.h drm: Don't include <drm/drm_encoder.h> in <drm/drm_crtc.h> 2016-12-18 16:29:29 +05:30
vmwgfx_ldu.c drm: Nuke fb->bits_per_pixel 2016-12-15 14:55:34 +02:00
vmwgfx_marker.c drm: vmwgfx: Use nsec based interfaces 2014-07-23 15:01:50 -07:00
vmwgfx_mob.c drm/vmwgfx: Use kmemdup instead of kmalloc and memcpy 2017-01-26 21:26:17 -08:00
vmwgfx_msg.c drm/vmwgfx: Add a check to handle host message failure 2016-07-01 10:47:47 -07:00
vmwgfx_msg.h drm/vmwgfx: Add VMWare host messaging capability 2016-05-20 17:12:33 +02:00
vmwgfx_overlay.c drm/vmwgfx: Fix up user_dmabuf refcounting 2015-09-14 01:13:11 -07:00
vmwgfx_prime.c drm/vmwgfx: Hook up the prime ioctls 2013-11-18 04:11:53 -08:00
vmwgfx_reg.h drm/vmwgfx: Fix copyright headers 2015-08-12 10:06:56 -07:00
vmwgfx_resource.c drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces 2017-03-30 11:43:39 +02:00
vmwgfx_resource_priv.h drm/vmwgfx: Fix copyright headers 2015-08-12 10:06:56 -07:00
vmwgfx_scrn.c drm: Nuke fb->bits_per_pixel 2016-12-15 14:55:34 +02:00
vmwgfx_shader.c drm/ttm: remove use_ticket parameter from ttm_bo_reserve 2016-05-04 20:21:21 -04:00
vmwgfx_so.c drm/vmwgfx: Fix copyright headers 2015-08-12 10:06:56 -07:00
vmwgfx_so.h drm/vmwgfx: Fix copyright headers 2015-08-12 10:06:56 -07:00
vmwgfx_stdu.c drm: Nuke fb->bits_per_pixel 2016-12-15 14:55:34 +02:00
vmwgfx_surface.c drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() 2017-03-30 11:46:26 +02:00
vmwgfx_ttm_glue.c drm/vmwgfx: Fix copyright headers 2015-08-12 10:06:56 -07:00