Li Qiang 4ddd24d54f drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() ...

commit e7e11f9956 upstream.

In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the
'req->mip_levels' array. This array can be assigned any value from
the user space. As both the 'num_sizes' and the array is uint32_t,
it is easy to make 'num_sizes' overflow. The later 'mip_levels' is
used as the loop count. This can lead an oob write. Add the check of
'req->mip_levels' to avoid this.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-04-12 12:41:11 +02:00

..

amd

drm/amdgpu: reinstate oland workaround for sclk

2017-03-30 09:41:27 +02:00

arc

drm/arcpgu: Accommodate adv7511 switch to DRM bridge

2016-11-11 04:31:35 +03:00

arm

drm: hdlcd: Fix cleanup order

2016-11-25 15:51:57 +00:00

armada

Merge branch 'drm-armada-fixes' of git://git.armlinux.org.uk/~rmk/linux-arm into drm-fixes

2016-10-21 13:26:15 +10:00

ast

drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS

2017-03-15 10:02:49 +08:00

atmel-hlcdc

Merge tag 'v4.8-rc8' into drm-next

2016-09-28 12:08:49 +10:00

bochs

Merge tag 'drm-qemu-20160921' of git://git.kraxel.org/linux into drm-next

2016-09-28 13:23:07 +10:00

bridge

drm/bridge: analogix dp: Fix runtime PM state on driver bind

2017-03-30 09:41:28 +02:00

cirrus

drm/drivers: add support for using the arch wc mapping API.

2016-10-26 16:48:01 +10:00

etnaviv

drm/etnaviv: (re-)protect fence allocation with GPU mutex

2017-04-08 09:30:35 +02:00

exynos

gpu/drm/exynos/exynos_hdmi - Unmap region obtained by of_iomap

2016-11-25 09:57:51 +10:00

fsl-dcu

drm/fsl-dcu: disable planes before disabling CRTC

2016-11-08 17:14:08 -08:00

gma500

drm/gma500: Add compat ioctl

2017-01-09 08:32:20 +01:00

hisilicon

drm: Don't swallow error codes in drm_dev_alloc()

2016-09-22 04:03:48 -07:00

i2c

Revert "drm/i2c: tda998x: don't register the connector"

2016-09-23 03:29:50 -07:00

i810

drm: Mark up legacy/dri1 drivers with DRM_LEGACY

2016-08-08 10:05:22 +02:00

i915

drm/i915: Fix not finding the VBT when it overlaps with OPREGION_ASLE_EXT

2017-03-15 10:02:51 +08:00

imx

drm/imx: imx-tve: Do not set the regulator voltage

2017-03-15 10:02:50 +08:00

mediatek

drm/mediatek: fix null pointer dereference

2016-11-24 14:53:15 +08:00

mga

drm: Mark up legacy/dri1 drivers with DRM_LEGACY

2016-08-08 10:05:22 +02:00

mgag200

drm/drivers: add support for using the arch wc mapping API.

2016-10-26 16:48:01 +10:00

msm

drm/msm: Fix error handling crashes seen when VRAM allocation fails

2016-11-04 11:51:37 -04:00

nouveau

drm/nouveau/disp/nv50-: specify ctrl/user separately when constructing classes

2017-03-22 12:43:38 +01:00

omapdrm

drm/atomic-helper: Add NO_DISABLE_AFTER_MODESET flag support for plane commit

2016-08-29 11:29:37 +02:00

panel

drm/panel: simple: Check against num_timings when setting preferred for timing

2017-01-19 20:18:06 +01:00

qxl

Merge tag 'drm-qemu-20160921' of git://git.kraxel.org/linux into drm-next

2016-09-28 13:23:07 +10:00

r128

drm: Mark up legacy/dri1 drivers with DRM_LEGACY

2016-08-08 10:05:22 +02:00

radeon

drm/radeon: Override fpfn for all VRAM placements in radeon_evict_flags

2017-04-08 09:30:35 +02:00

rcar-du

drm: Don't force all planes to be added to the state due to zpos

2016-10-26 18:48:05 +02:00

rockchip

drm/rockchip: analogix_dp: Refuse to enable PSR if panel doesn't support it

2016-10-04 08:23:17 +02:00

savage

drm/savage: dereferencing an error pointer

2017-01-19 20:17:58 +01:00

shmobile

drm/shmobile: make fbdev support really optional

2016-07-18 09:11:37 +02:00

sis

drm: Mark up legacy/dri1 drivers with DRM_LEGACY

2016-08-08 10:05:22 +02:00

sti

drm: Don't force all planes to be added to the state due to zpos

2016-10-26 18:48:05 +02:00

sun4i

drm/sun4i: Propagate error to the caller

2016-11-07 16:09:35 +01:00

tdfx

drm: Mark up legacy/dri1 drivers with DRM_LEGACY

2016-08-08 10:05:22 +02:00

tegra

drm/tegra: dpaux: Fix error handling

2017-01-19 20:17:58 +01:00

tilcdc

Merge tag 'tilcdc-4.9-3.1' of https://github.com/jsarha/linux into drm-next

2016-09-28 11:17:26 +10:00

ttm

drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

2017-04-12 12:41:10 +02:00

udl

drm/udl: make control msg static const. (v2)

2016-11-11 08:57:34 +10:00

vc4

drm/vc4: Allocate the right amount of space for boot-time CRTC state.

2017-04-08 09:30:35 +02:00

vgem

drm: Don't swallow error codes in drm_dev_alloc()

2016-09-22 04:03:48 -07:00

via

mm: replace get_user_pages() write/force parameters with gup_flags

2016-10-19 08:11:43 -07:00

virtio

virtio-gpu: fix vblank events

2016-11-03 10:14:19 +10:00

vmwgfx

drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

2017-04-12 12:41:11 +02:00

ati_pcigart.c

…

drm_agpsupport.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_atomic_helper.c

drm: reference count event->completion

2017-03-30 09:41:28 +02:00

drm_atomic.c

drm/atomic: Fix double free in drm_atomic_state_default_clear

2017-02-14 15:25:36 -08:00

drm_auth.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_blend.c

drm/doc: Polish plane composition property docs

2016-09-22 00:04:02 -07:00

drm_bridge.c

drm: Extract drm_bridge.h

2016-09-19 15:04:15 +02:00

drm_bufs.c

GPU-DRM: Replace a kzalloc() call by kcalloc() in drm_legacy_addbufs_sg()

2016-09-21 13:24:27 +02:00

drm_cache.c

drm: Restore double clflush on the last partial cacheline

2016-07-12 15:57:13 +02:00

drm_color_mgmt.c

drm/doc: Document color space handling

2016-09-22 00:04:03 -07:00

drm_connector.c

drm: Release resources with a safer function

2016-10-10 11:20:48 +02:00

drm_context.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_crtc_helper_internal.h

drm/fb-helper: Fix sparse warnings

2016-09-19 16:45:15 +02:00

drm_crtc_helper.c

drm/kms-helpers: Extract drm_modeset_helper.[hc]

2016-08-16 16:10:19 +02:00

drm_crtc_internal.h

drm: Extract drm_color_mgmt.[hc]

2016-09-22 00:04:02 -07:00

drm_crtc.c

drm: Extract drm_color_mgmt.[hc]

2016-09-22 00:04:02 -07:00

drm_debugfs.c

gpu: use %pd

2016-08-07 23:38:48 -04:00

drm_dma.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_dp_aux_dev.c

drm: Don't export dp-aux devnode functions

2016-08-16 18:49:26 +02:00

drm_dp_dual_mode_helper.c

drm: Add helper for DP++ adaptors

2016-05-23 11:10:46 +03:00

drm_dp_helper.c

Merge tag 'drm-for-v4.9' of git://people.freedesktop.org/~airlied/linux

2016-10-11 18:12:22 -07:00

drm_dp_mst_topology.c

drm/dp/mst: fix kernel oops when turning off secondary monitor

2017-02-23 17:44:36 +01:00

drm_drv.c

drm: Simplify drm_printk to reduce object size quite a bit

2016-10-04 08:23:14 +02:00

drm_edid_load.c

Fix annoyingly awkward typo in drm_edid_load.c

2016-05-30 09:59:28 +02:00

drm_edid.c

drm/edid: Add EDID_QUIRK_FORCE_8BPC quirk for Rotel RSX-1058

2017-03-15 10:02:49 +08:00

drm_encoder_slave.c

…

drm_encoder.c

drm: Fix typo in encoder docs

2016-09-21 13:33:50 +02:00

drm_fb_cma_helper.c

Merge branch 'for-next' of http://git.agner.ch/git/linux-drm-fsl-dcu into drm-next

2016-07-02 16:21:35 +10:00

drm_fb_helper.c

drm: Cancel drm_fb_helper_resume_work on unload

2017-03-15 10:02:50 +08:00

drm_flip_work.c

…

drm_fops.c

drm: reference count event->completion

2017-03-30 09:41:28 +02:00

drm_fourcc.c

drm: move drm_mode_legacy_fb_format to drm_fourcc.c

2016-08-29 15:37:28 +02:00

drm_framebuffer.c

drm: Extract drm_plane.[hc]

2016-09-22 00:01:56 -07:00

drm_gem_cma_helper.c

drm: Wrap direct calls to driver->gem_free_object from CMA

2016-06-01 15:00:28 +10:00

drm_gem.c

drm: use drm_file to tag vm-bos

2016-09-19 11:22:08 +02:00

drm_global.c

drm: modify drm_global_item_ref to avoid two times of writing ref->object

2016-09-14 15:10:29 -04:00

drm_hashtab.c

drm: fix signed integer overflow

2016-09-06 13:56:41 -04:00

drm_info.c

drm: Print device information again in debugfs

2016-10-17 16:20:53 +10:00

drm_internal.h

drm: drop obsolete drm_core.h

2016-09-19 13:57:38 +02:00

drm_ioc32.c

drm: drop obsolete drm_core.h

2016-09-19 13:57:38 +02:00

drm_ioctl.c

drm: Don't call drm_for_each_crtc with a non-KMS driver

2016-11-30 10:13:00 +01:00

drm_irq.c

drm: avoid uninitialized timestamp use in wait_vblank

2017-01-19 20:18:06 +01:00

drm_kms_helper_common.c

drm: Don't export dp-aux devnode functions

2016-08-16 18:49:26 +02:00

drm_legacy.h

drm: Hide hw.lock cleanup in filp->release better

2016-06-16 10:16:37 +02:00

drm_lock.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_memory.c

drm: Fix broken use of _PAGE_NO_CACHE on powerpc

2016-07-12 13:20:39 +02:00

drm_mipi_dsi.c

drm/dsi: Implement DCS set/get display brightness

2016-08-24 13:34:00 +02:00

drm_mm.c

drm: Initialise drm_mm.head_node.allocated

2017-01-19 20:18:06 +01:00

drm_mode_object.c

drm: Move property validation to a helper, v2.

2016-09-12 10:32:49 -04:00

drm_modes.c

drm: Fix broken VT switch with video=1366x768 option

2017-02-01 08:33:02 +01:00

drm_modeset_helper.c

drm/kms-helpers: Extract drm_modeset_helper.[hc]

2016-08-16 16:10:19 +02:00

drm_modeset_lock.c

drm/doc: Switch to sphinx/rst fixed-width quoting

2016-06-03 20:58:24 +02:00

drm_of.c

…

drm_panel.c

drm/panel: Flesh out kerneldoc

2016-05-06 16:04:48 +02:00

drm_pci.c

drm: Don't swallow error codes in drm_dev_alloc()

2016-09-22 04:03:48 -07:00

drm_plane_helper.c

drm: Fix kerneldoc in drm_plane_helper.c

2016-08-16 18:50:04 +02:00

drm_plane.c

drm: Undo damage to page_flip_ioctl

2016-10-04 12:53:12 +10:00

drm_platform.c

drm: Don't swallow error codes in drm_dev_alloc()

2016-09-22 04:03:48 -07:00

drm_prime.c

drm: Fix up kerneldoc for new drm_gem_dmabuf_export()

2016-10-10 11:19:42 +02:00

drm_probe_helper.c

drm: Schedule the output_poll_work with 1s delay if we have delayed event

2017-02-01 08:33:02 +01:00

drm_property.c

Revert "drm: Unify handling of blob and object properties"

2016-09-07 13:24:22 +03:00

drm_rect.c

drm: Warn about negative sizes when calculating scale factor

2016-08-08 14:17:56 -04:00

drm_scatter.c

drm: Used DRM_LEGACY for all legacy functions

2016-08-08 10:05:23 +02:00

drm_simple_kms_helper.c

drm: simple_kms_helper: Add prepare_fb and cleanup_fb hooks

2016-10-05 15:18:02 +02:00

drm_sysfs.c

drm: drop obsolete drm_core.h

2016-09-19 13:57:38 +02:00

drm_trace_points.c

…

drm_trace.h

…

drm_vm.c

drm: Fix broken use of _PAGE_NO_CACHE on powerpc

2016-07-12 13:20:39 +02:00

drm_vma_manager.c

drm: use drm_file to tag vm-bos

2016-09-19 11:22:08 +02:00

Kconfig

Revert "drm: make DRI1 drivers depend on BROKEN"

2016-09-01 06:16:12 +10:00

Makefile

drm: Extract drm_color_mgmt.[hc]

2016-09-22 00:04:02 -07:00