Re: [patch 3/4] drm/qxl: array underflow in qxl_clientcap_ioctl()

From: Frediano Ziglio <fziglio@redhat.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Dave Airlie <airlied@redhat.com>,
	security@kernel.org,
	Ilja Van Sprundel <ivansprundel@ioactive.com>,
	dri-devel@lists.freedesktop.org
Subject: Re: [patch 3/4] drm/qxl: array underflow in qxl_clientcap_ioctl()
Date: Thu, 17 Sep 2015 10:16:34 -0400 (EDT)	[thread overview]
Message-ID: <1002571808.28239757.1442499394422.JavaMail.zimbra@redhat.com> (raw)
In-Reply-To: <20150917112352.GC4882@mwanda>

> 
> We check that "byte" isn't writing beyond the end of the array but we
> also need to prevent array underflow.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c
> b/drivers/gpu/drm/qxl/qxl_ioctl.c
> index b2db482..552dc06 100644
> --- a/drivers/gpu/drm/qxl/qxl_ioctl.c
> +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
> @@ -372,7 +372,7 @@ static int qxl_clientcap_ioctl(struct drm_device *dev,
> void *data,
>  {
>  	struct qxl_device *qdev = dev->dev_private;
>  	struct drm_qxl_clientcap *param = data;
> -	int byte, idx;
> +	unsigned int byte, idx;
>  
>  	byte = param->index / 8;
>  	idx = param->index % 8;
> 

Actually there is no underflow. param->index is unsigned so either byte and
idx are at the end positive as long as int is not less then 4 bytes (which
I don't think is supported under Linux).

However I agree with the patch.

Acked!

Frediano Ziglio
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel