Commit bab9efc2 authored by Xi Wang's avatar Xi Wang Committed by Dave Airlie

vmwgfx: integer overflow in vmw_kms_update_layout_ioctl()

There are two issues in vmw_kms_update_layout_ioctl().  First, the
for loop forgets to index rects and only checks the first element.
Second, there is a potential integer overflow if userspace passes
in a large arg->num_outputs.  The call to kzalloc() would allocate
a small buffer, leading to out-of-bounds read.
Reported-by: default avatarHaogang Chen <haogangchen@gmail.com>
Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent f3a71df0
...@@ -1809,7 +1809,8 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data, ...@@ -1809,7 +1809,8 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
} }
rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect); rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
rects = kzalloc(rects_size, GFP_KERNEL); rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
GFP_KERNEL);
if (unlikely(!rects)) { if (unlikely(!rects)) {
ret = -ENOMEM; ret = -ENOMEM;
goto out_unlock; goto out_unlock;
...@@ -1824,10 +1825,10 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data, ...@@ -1824,10 +1825,10 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
} }
for (i = 0; i < arg->num_outputs; ++i) { for (i = 0; i < arg->num_outputs; ++i) {
if (rects->x < 0 || if (rects[i].x < 0 ||
rects->y < 0 || rects[i].y < 0 ||
rects->x + rects->w > mode_config->max_width || rects[i].x + rects[i].w > mode_config->max_width ||
rects->y + rects->h > mode_config->max_height) { rects[i].y + rects[i].h > mode_config->max_height) {
DRM_ERROR("Invalid GUI layout.\n"); DRM_ERROR("Invalid GUI layout.\n");
ret = -EINVAL; ret = -EINVAL;
goto out_free; goto out_free;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment