From mboxrd@z Thu Jan  1 00:00:00 1970
From: Dan Carpenter <dan.carpenter@oracle.com>
Subject: [patch 4/4] drm/qxl: integer overflow in qxl_alloc_surf_ioctl()
Date: Thu, 17 Sep 2015 14:24:42 +0300
Message-ID: <20150917112442.GD4882@mwanda>
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Return-path: <dri-devel-bounces@lists.freedesktop.org>
Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81])
 by gabe.freedesktop.org (Postfix) with ESMTPS id 8CC076E686
 for <dri-devel@lists.freedesktop.org>; Thu, 17 Sep 2015 04:24:56 -0700 (PDT)
Content-Disposition: inline
List-Unsubscribe: <http://lists.freedesktop.org/mailman/options/dri-devel>,
 <mailto:dri-devel-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <http://lists.freedesktop.org/archives/dri-devel>
List-Post: <mailto:dri-devel@lists.freedesktop.org>
List-Help: <mailto:dri-devel-request@lists.freedesktop.org?subject=help>
List-Subscribe: <http://lists.freedesktop.org/mailman/listinfo/dri-devel>,
 <mailto:dri-devel-request@lists.freedesktop.org?subject=subscribe>
Errors-To: dri-devel-bounces@lists.freedesktop.org
Sender: "dri-devel" <dri-devel-bounces@lists.freedesktop.org>
To: David Airlie <airlied@linux.ie>
Cc: Dave Airlie <airlied@redhat.com>, security@kernel.org, Ilja Van Sprundel <ivansprundel@ioactive.com>, dri-devel@lists.freedesktop.org, Frediano Ziglio <fziglio@redhat.com>
List-Id: dri-devel@lists.freedesktop.org

VGhlIHNpemUgY2FsY3VsYXRpb24gY2FuIG92ZXJmbG93LgoKU2lnbmVkLW9mZi1ieTogRGFuIENh
cnBlbnRlciA8ZGFuLmNhcnBlbnRlckBvcmFjbGUuY29tPgoKZGlmZiAtLWdpdCBhL2RyaXZlcnMv
Z3B1L2RybS9xeGwvcXhsX2lvY3RsLmMgYi9kcml2ZXJzL2dwdS9kcm0vcXhsL3F4bF9pb2N0bC5j
CmluZGV4IDU1MmRjMDYuLjVkYTlhNjAgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvZ3B1L2RybS9xeGwv
cXhsX2lvY3RsLmMKKysrIGIvZHJpdmVycy9ncHUvZHJtL3F4bC9xeGxfaW9jdGwuYwpAQCAtNDAx
LDYgKzQwMSw4IEBAIHN0YXRpYyBpbnQgcXhsX2FsbG9jX3N1cmZfaW9jdGwoc3RydWN0IGRybV9k
ZXZpY2UgKmRldiwgdm9pZCAqZGF0YSwKIAogCS8qIHdvcmsgb3V0IHNpemUgYWxsb2NhdGUgYm8g
d2l0aCBoYW5kbGUgKi8KIAlhY3R1YWxfc3RyaWRlID0gcGFyYW0tPnN0cmlkZSA8IDAgPyAtcGFy
YW0tPnN0cmlkZSA6IHBhcmFtLT5zdHJpZGU7CisJaWYgKGFjdHVhbF9zdHJpZGUgPiAoSU5UX01B
WCAtIGFjdHVhbF9zdHJpZGUpIC8gcGFyYW0tPmhlaWdodCkKKwkJcmV0dXJuIC1FSU5WQUw7CiAJ
c2l6ZSA9IGFjdHVhbF9zdHJpZGUgKiBwYXJhbS0+aGVpZ2h0ICsgYWN0dWFsX3N0cmlkZTsKIAog
CXN1cmYuZm9ybWF0ID0gcGFyYW0tPmZvcm1hdDsKX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlz
dHMuZnJlZWRlc2t0b3Aub3JnCmh0dHA6Ly9saXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9s
aXN0aW5mby9kcmktZGV2ZWwK