Li Qiang c21636bd64 drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() ...

commit e7e11f9956 upstream.

In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the
'req->mip_levels' array. This array can be assigned any value from
the user space. As both the 'num_sizes' and the array is uint32_t,
it is easy to make 'num_sizes' overflow. The later 'mip_levels' is
used as the loop count. This can lead an oob write. Add the check of
'req->mip_levels' to avoid this.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-04-12 12:38:33 +02:00

..

amd

drm/amdgpu: add missing irq.h include

2017-03-26 12:13:18 +02:00

armada

drm/armada: Convert the probe function to the generic drm_of_component_probe()

2015-10-20 12:01:34 +02:00

ast

drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS

2017-03-15 09:57:14 +08:00

atmel-hlcdc

drm: atmel-hlcdc: Fix vertical scaling

2016-09-24 10:07:42 +02:00

bochs

drm/bochs: Don't grab dev->struct_mutex for in mmap offset ioctl

2015-08-10 13:37:04 +02:00

bridge

Merge tag 'drm/panel/for-4.4-rc1' of git://anongit.freedesktop.org/tegra/linux into drm-next

2015-11-05 11:07:13 +10:00

cirrus

drm/cirrus: Don't grab dev->struct_mutex for in mmap offset ioctl

2015-08-10 13:37:27 +02:00

exynos

drm/exynos: fix error handling in exynos_drm_subdrv_open

2016-11-10 16:36:36 +01:00

fsl-dcu

drm: Stop using drm_vblank_count() as the hw frame counter

2015-10-07 16:13:52 +02:00

gma500

drm/gma500: Add compat ioctl

2017-01-09 08:07:46 +01:00

i2c

Merge branch 'drm-tda998x-devel' of git://ftp.arm.linux.org.uk/~rmk/linux-arm into drm-next

2015-10-15 14:17:13 +10:00

i810

drm: move drm_mmap to <drm/drm_legacy.h>

2014-09-24 11:43:07 +10:00

i915

drm/i915/dsi: Do not clear DPOUNIT_CLOCK_GATE_DISABLE from vlv_init_display_clock_gating

2017-03-15 09:57:15 +08:00

imx

drm/imx: Match imx-ipuv3-crtc components using device node in platform data

2016-06-07 18:14:37 -07:00

mga

drm/irq: Use unsigned int pipe in public API

2015-10-06 12:57:47 +02:00

mgag200

drm/mgag200: Black screen fix for G200e rev 4

2016-07-27 09:47:32 -07:00

msm

drm/msm: fix use of copy_from_user() while holding spinlock

2016-09-15 08:27:51 +02:00

nouveau

drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval

2017-02-09 08:02:44 +01:00

omapdrm

drm/omap: fix fbdev pix format to support all platforms

2015-12-14 10:00:22 +02:00

panel

spi: Drop owner assignment from spi_drivers

2015-10-28 10:30:17 +09:00

qxl

qxl: check for kmap failures

2016-09-30 10:18:39 +02:00

r128

drm/irq: Use unsigned int pipe in public API

2015-10-06 12:57:47 +02:00

radeon

drm/radeon: Override fpfn for all VRAM placements in radeon_evict_flags

2017-04-08 09:53:31 +02:00

rcar-du

drm: rcar-du: Add support for the R8A7794 DU

2015-10-21 18:52:38 +03:00

rockchip

drm/rockchip: Use CRTC vblank event interface

2015-12-02 10:22:21 +08:00

savage

drm: move drm_mmap to <drm/drm_legacy.h>

2014-09-24 11:43:07 +10:00

shmobile

drm: Stop using drm_vblank_count() as the hw frame counter

2015-10-07 16:13:52 +02:00

sis

include/uapi/drm/sis_drm.h: move sis_file_private to drivers/gpu/drm/sis/sis_drv.h

2015-10-16 11:27:46 +10:00

sti

drm/sti: load HQVDP firmware the first time HQVDP's plane is used

2015-11-03 13:04:56 +01:00

tdfx

drm: move drm_mmap to <drm/drm_legacy.h>

2014-09-24 11:43:07 +10:00

tegra

Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux

2015-11-10 09:33:06 -08:00

tilcdc

drm: Stop using drm_vblank_count() as the hw frame counter

2015-10-07 16:13:52 +02:00

ttm

drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

2017-04-12 12:38:33 +02:00

udl

drm/udl: Use unlocked gem unreferencing

2016-04-20 15:41:55 +09:00

vc4

drm/vc4: Make sure that planes aren't scaled.

2015-11-17 12:27:03 -08:00

vgem

drm/vgem: Drop vgem_drm_gem_mmap

2015-10-19 11:00:44 +02:00

via

via_drm.h: move struct via_file_private definition to drivers/gpu/drm/via/via_drv.h

2015-10-16 11:27:49 +10:00

virtio

virtio-gpu: use no-merge for fill-modes

2015-12-01 10:33:35 +10:00

vmwgfx

drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

2017-04-12 12:38:33 +02:00

ati_pcigart.c

drm: split ati_pcigart.h out of drmP.h

2014-09-12 14:11:14 +10:00

drm_agpsupport.c

drm: Remove __OS_HAS_AGP

2015-09-30 10:44:48 +02:00

drm_atomic_helper.c

drm/atomic: fix an error code in mode_fixup()

2017-03-15 09:57:15 +08:00

drm_atomic.c

drm: make drm_atomic_set_mode_prop_for_crtc() more reliable

2016-07-27 09:47:35 -07:00

drm_auth.c

drm: simplify authentication management

2015-05-05 09:45:57 +02:00

drm_bridge.c

drm/DocBook: Add more drm_bridge documentation

2015-05-21 13:56:51 +02:00

drm_bufs.c

drm: Remove __OS_HAS_AGP

2015-09-30 10:44:48 +02:00

drm_cache.c

drm: Restore double clflush on the last partial cacheline

2016-08-20 18:09:23 +02:00

drm_context.c

drm: Convert drm_legacy_ctxbitmap_init to void return type

2015-07-02 17:00:48 +02:00

drm_crtc_helper.c

drm: Make the connector dpms callback return a value, v2.

2015-07-27 16:23:28 +02:00

drm_crtc_internal.h

drm/atomic: Hide drm.ko internal interfaces

2015-01-05 13:55:30 +01:00

drm_crtc.c

drm: Reject page_flip for !DRIVER_MODESET

2016-09-15 08:27:51 +02:00

drm_debugfs.c

drm: Move piles of functions from drmP.h to drm_internal.h

2014-09-12 11:16:29 +02:00

drm_dma.c

drm: Move legacy buffer structures to <drm/drm_legacy.h>

2014-09-12 15:28:12 +02:00

drm_dp_helper.c

drm/dp: move hw_mutex up the call stack

2016-04-20 15:41:55 +09:00

drm_dp_mst_topology.c

drm/dp/mst: fix kernel oops when turning off secondary monitor

2017-02-23 17:43:09 +01:00

drm_drv.c

drm: Fix an unwanted master inheritance v2

2015-12-04 12:28:14 +10:00

drm_edid_load.c

drm: Constify generic_edid_names[]

2015-09-08 13:45:52 +02:00

drm_edid.c

drm/edid: Add EDID_QUIRK_FORCE_8BPC quirk for Rotel RSX-1058

2017-03-15 09:57:15 +08:00

drm_encoder_slave.c

…

drm_fb_cma_helper.c

drm/fb_cma_helper: Use new drm_fb_helper functions

2015-08-06 14:13:00 +02:00

drm_fb_helper.c

drm/fb_helper: Fix references to dev->mode_config.num_connector

2016-06-07 18:14:36 -07:00

drm_flip_work.c

drm/core: get rid of -Iinclude/drm

2015-05-13 11:28:22 +02:00

drm_fops.c

drm: Fix an unwanted master inheritance v2

2015-12-04 12:28:14 +10:00

drm_gem_cma_helper.c

Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux

2015-11-10 09:33:06 -08:00

drm_gem.c

drm: Balance error path for GEM handle allocation

2016-09-15 08:27:47 +02:00

drm_global.c

…

drm_hashtab.c

list: fix order of arguments for hlist_add_after(_rcu)

2014-08-06 18:01:24 -07:00

drm_info.c

drm: Silence sparse warnings

2015-03-13 17:37:35 +01:00

drm_internal.h

drm: move drm_class into drm_sysfs.c

2015-09-09 15:05:17 +02:00

drm_ioc32.c

drm: Only use compat ioctl for addfb2 on X86/IA64

2016-09-24 10:07:43 +02:00

drm_ioctl.c

drm: Enforce unlocked ioctl operation for kms driver ioctls

2015-10-16 15:50:54 +02:00

drm_irq.c

drm: Fix treatment of drm_vblank_offdelay in drm_vblank_on() (v2)

2016-03-03 15:07:23 -08:00

drm_legacy.h

drm: Convert drm_legacy_ctxbitmap_init to void return type

2015-07-02 17:00:48 +02:00

drm_lock.c

signals: kill block_all_signals() and unblock_all_signals()

2015-11-06 17:50:42 -08:00

drm_memory.c

drm: Remove __OS_HAS_AGP

2015-09-30 10:44:48 +02:00

drm_mipi_dsi.c

drm/mipi-dsi: Avoid potential NULL pointer dereference

2015-01-28 08:45:37 +01:00

drm_mm.c

drm/mm: Do DRM_MM_CREATE_TOP adj_start calculation after color_adjust

2015-09-08 13:45:47 +02:00

drm_modes.c

drm: Fix broken VT switch with video=1366x768 option

2017-02-01 08:30:52 +01:00

drm_modeset_lock.c

drm/atomic: Make sure lock is held in trylock contexts.

2015-09-08 13:45:53 +02:00

drm_of.c

drm: Introduce generic probe function for component based masters.

2015-10-20 12:01:29 +02:00

drm_panel.c

…

drm_pci.c

drm/doc: Update docs about device instance setup

2015-09-30 10:06:06 +02:00

drm_plane_helper.c

drm/atomic: Make prepare_fb/cleanup_fb only take state, v3.

2015-09-08 13:45:54 +02:00

drm_platform.c

drm/doc: Update docs about device instance setup

2015-09-30 10:06:06 +02:00

drm_prime.c

drm/prime: Pass the right module owner through to dma_buf_export()

2016-10-31 04:13:57 -06:00

drm_probe_helper.c

drm: Don't overwrite UNVERFIED mode status to OK

2015-12-15 11:00:10 +10:00

drm_rect.c

drm: Use DRM_ROTATE_MASK and DRM_REFLECT_MASK

2015-10-05 15:32:51 +02:00

drm_scatter.c

drm: Move sg functions into drm_legacy.h

2014-09-12 11:08:54 +02:00

drm_sysfs.c

Merge commit '06d1ee32a4d25356a710b49d5e95dbdd68bdf505' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into drm-next

2015-10-16 10:25:28 +10:00

drm_trace_points.c

…

drm_trace.h

tracing/drm: Remove unused TRACE_SYSTEM_STRING define

2015-04-07 12:29:23 -04:00

drm_vm.c

drm: Remove __OS_HAS_AGP

2015-09-30 10:44:48 +02:00

drm_vma_manager.c

drm/gem: Use kref_get_unless_zero for the weak mmap references

2015-10-19 11:00:44 +02:00

Kconfig

drm/vc4: Add KMS support for Raspberry Pi.

2015-10-21 10:33:12 +01:00

Makefile

Merge tag 'drm-vc4-next-2015-10-21' of http://github.com/anholt/linux into drm-next

2015-10-22 10:31:17 +10:00