From: Frediano Ziglio Subject: Re: [patch 4/4] drm/qxl: integer overflow in qxl_alloc_surf_ioctl() Date: Fri, 18 Sep 2015 05:46:04 -0400 (EDT) Message-ID: <421515033.28673933.1442569564307.JavaMail.zimbra@redhat.com> References: <20150917112442.GD4882@mwanda> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mx6-phx2.redhat.com (mx6-phx2.redhat.com [209.132.183.39]) by gabe.freedesktop.org (Postfix) with ESMTPS id 3BECD6E2FF for ; Fri, 18 Sep 2015 02:46:16 -0700 (PDT) In-Reply-To: <20150917112442.GD4882@mwanda> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Dan Carpenter Cc: Dave Airlie , security@kernel.org, Ilja Van Sprundel , dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org PiBUaGUgc2l6ZSBjYWxjdWxhdGlvbiBjYW4gb3ZlcmZsb3cuCj4gCj4gU2lnbmVkLW9mZi1ieTog RGFuIENhcnBlbnRlciA8ZGFuLmNhcnBlbnRlckBvcmFjbGUuY29tPgo+IAo+IGRpZmYgLS1naXQg YS9kcml2ZXJzL2dwdS9kcm0vcXhsL3F4bF9pb2N0bC5jCj4gYi9kcml2ZXJzL2dwdS9kcm0vcXhs L3F4bF9pb2N0bC5jCj4gaW5kZXggNTUyZGMwNi4uNWRhOWE2MCAxMDA2NDQKPiAtLS0gYS9kcml2 ZXJzL2dwdS9kcm0vcXhsL3F4bF9pb2N0bC5jCj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL3F4bC9x eGxfaW9jdGwuYwo+IEBAIC00MDEsNiArNDAxLDggQEAgc3RhdGljIGludCBxeGxfYWxsb2Nfc3Vy Zl9pb2N0bChzdHJ1Y3QgZHJtX2RldmljZSAqZGV2LAo+IHZvaWQgKmRhdGEsCj4gIAo+ICAJLyog d29yayBvdXQgc2l6ZSBhbGxvY2F0ZSBibyB3aXRoIGhhbmRsZSAqLwo+ICAJYWN0dWFsX3N0cmlk ZSA9IHBhcmFtLT5zdHJpZGUgPCAwID8gLXBhcmFtLT5zdHJpZGUgOiBwYXJhbS0+c3RyaWRlOwo+ ICsJaWYgKGFjdHVhbF9zdHJpZGUgPiAoSU5UX01BWCAtIGFjdHVhbF9zdHJpZGUpIC8gcGFyYW0t PmhlaWdodCkKPiArCQlyZXR1cm4gLUVJTlZBTDsKPiAgCXNpemUgPSBhY3R1YWxfc3RyaWRlICog cGFyYW0tPmhlaWdodCArIGFjdHVhbF9zdHJpZGU7Cj4gIAo+ICAJc3VyZi5mb3JtYXQgPSBwYXJh bS0+Zm9ybWF0Owo+IAoKVGhlcmUgYXJlIHNvbWUgaXNzdWVzIGhlcmUuIHBhcmFtLT5zdHJpZGUg Y2FuIGJlIC0yXjMxIHNvIGFjdHVhbF9zdHJpZGUgd2lsbApiZSBwcm9iYWJseSAtMl4zMS4gWW91 IGludHJvZHVjZWQgYSBwb3NzaWJsZSBkaXZpc2lvbiBieSB6ZXJvIChwYXJhbS0+aGVpZ2h0ID09 IDApLgpEbyB5b3Uga25vdyB3aG8gdmFsaWRhdGUgdGhlIHN0cnVjdHVyZSBzaXplPyBJIGRvbid0 IHNlZSBhbnkgY2hlY2sgb24gdGhlIGNvZGUuCkxvb2tzIGxpa2UgdGhlIGRhdGEgcG9pbnRlciBp cyBjb21pbmcgZnJvbSB1c2Vyc3BhY2UgdW50ZXN0ZWQuCkFuIGVhc2llc3Qgd2F5IHRvIGRvIHRo ZXNlIGNoZWNrIGlzIHVzZSA2NCBiaXQgYXJpdGhtZXRpYyBzbyBzb21ldGhpbmcgbGlrZQoKICAg dTY0IGFjdHVhbF9zdHJpZGUsIHNpemU7CgogICBhY3R1YWxfc3RyaWRlID0gcGFyYW0tPnN0cmlk ZSA8IDAgPyAtcGFyYW0tPnN0cmlkZSA6IHBhcmFtLT5zdHJpZGU7CiAgIHNpemUgPSBhY3R1YWxf c3RyaWRlICogcGFyYW0tPmhlaWdodCArIGFjdHVhbF9zdHJpZGU7CiAgIGlmIChzaXplID4gSU5U X01BWCkKICAgICAgIHJldHVybiAtRUlOVkFMOwoKdGFrZSBpbnRvIGFjY291bnQgdGhhdCB1c3Vh bGx5IGRpdmlzaW9uIGlzIHF1aXRlIHNsb3cgc28gb24gbWFueSBzeXN0ZW0gZXZlbiBpZiAzMiBi aXQKdGhlIG11bHRpcGxpY2F0aW9uIGlzIGZhc3Rlci4gQW5kIGlmIGlzIG5vdCBmYXN0ZXIgeW91 IGFyZSBjcmVhdGluZyBhIHN1cmZhY2Ugc28KaXMgbm90IHJlYWxseSBhIGZhc3QgcGF0aC4KCllv dSBzaG91bGQgYWxzbyBjaGVjayBpZiB0aGUgc3RyaWRlIGNvbXB1dGVkIGZyb20gd2lkdGggYW5k IGZvcm1hdCBmaXQgaW50byB0aGUgc3RyaWRlCnByb3ZpZGVkLgoKRG8geW91IGtub3cgd2h5IGFj dHVhbF9zdHJpZGUgKiBwYXJhbS0+aGVpZ2h0IGlzIG5vdCBlbm91Z2g/IFdoeSBhbiBleHRyYSBs aW5lPwoKUmVnYXJkcywKICBGcmVkaWFubwpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwpkcmktZGV2ZWwgbWFpbGluZyBsaXN0CmRyaS1kZXZlbEBsaXN0cy5m cmVlZGVza3RvcC5vcmcKaHR0cDovL2xpc3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3Rp bmZvL2RyaS1kZXZlbAo=