lkml.org 
[lkml]   [2017]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 105/178] drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
    3.16.46-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Murray McAllister <murray.mcallister@insomniasec.com>

    commit 63774069d9527a1aeaa4aa20e929ef5e8e9ecc38 upstream.

    In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is
    used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()),
    which can leak useful addresses to dmesg.

    Add check to avoid a size of 0.

    Signed-off-by: Murray McAllister <murray.mcallister@insomniasec.com>
    Reviewed-by: Sinclair Yeh <syeh@vmware.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
    +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
    @@ -161,7 +161,7 @@ int vmw_get_cap_3d_ioctl(struct drm_devi
    bool gb_objects = !!(dev_priv->capabilities & SVGA_CAP_GBOBJECTS);
    struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);

    - if (unlikely(arg->pad64 != 0)) {
    + if (unlikely(arg->pad64 != 0 || arg->max_size == 0)) {
    DRM_ERROR("Illegal GET_3D_CAP argument.\n");
    return -EINVAL;
    }
    \
     
     \ /
      Last update: 2017-07-16 16:10    [W:2.157 / U:0.040 seconds]
    ©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site