From mboxrd@z Thu Jan  1 00:00:00 1970
From: Dan Carpenter <dan.carpenter@oracle.com>
Subject: [PATCH] drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl()
Date: Wed, 9 May 2018 10:22:49 +0300
Message-ID: <20180509072249.GA12754@mwanda>
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Return-path: <dri-devel-bounces@lists.freedesktop.org>
Received: from aserp2120.oracle.com (aserp2120.oracle.com [141.146.126.78])
 by gabe.freedesktop.org (Postfix) with ESMTPS id 0694A6E78A
 for <dri-devel@lists.freedesktop.org>; Wed,  9 May 2018 07:23:07 +0000 (UTC)
Content-Disposition: inline
List-Unsubscribe: <https://lists.freedesktop.org/mailman/options/dri-devel>,
 <mailto:dri-devel-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <https://lists.freedesktop.org/archives/dri-devel>
List-Post: <mailto:dri-devel@lists.freedesktop.org>
List-Help: <mailto:dri-devel-request@lists.freedesktop.org?subject=help>
List-Subscribe: <https://lists.freedesktop.org/mailman/listinfo/dri-devel>,
 <mailto:dri-devel-request@lists.freedesktop.org?subject=subscribe>
Errors-To: dri-devel-bounces@lists.freedesktop.org
Sender: "dri-devel" <dri-devel-bounces@lists.freedesktop.org>
To: Gustavo Padovan <gustavo@padovan.org>, David Herrmann <dh.herrmann@gmail.com>
Cc: David Airlie <airlied@linux.ie>, kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org
List-Id: dri-devel@lists.freedesktop.org

VGhlcmUgaXMgYSBjb21tZW50IGhlcmUgd2hpY2ggc2F5cyB0aGF0IERJVl9ST1VORF9VUCgpIGFu
ZCB0aGF0J3Mgd2hlcmUKdGhlIHByb2JsZW0gY29tZXMgZnJvbS4gIFNheSB5b3UgcGljazoKCglh
cmdzLT5icHAgPSBVSU5UX01BWCAtIDc7CglhcmdzLT53aWR0aCA9IDQ7CglhcmdzLT5oZWlnaHQg
PSAxOwoKVGhlIGludGVnZXIgb3ZlcmZsb3cgaW4gRElWX1JPVU5EX1VQKCkgbWVhbnMgImNwcCIg
aXMgVUlOVF9NQVggLyA4IGFuZApiZWNhdXNlIG9mIGhvdyB3ZSBwaWNrZWQgYXJncy0+d2lkdGgg
dGhhdCBtZWFucyBjcHAgPCBVSU5UX01BWCAvIDQuCgpTaWduZWQtb2ZmLWJ5OiBEYW4gQ2FycGVu
dGVyIDxkYW4uY2FycGVudGVyQG9yYWNsZS5jb20+Ci0tLQpCdHcsIERJVl9ST1VORF9VUCgpIGlu
dGVnZXIgb3ZlcmZsb3dzIGhhdmUgYmVlbiBhIHJlY3VycmluZyBzb3VyY2Ugb2YKYnVncyBzbyBJ
IGhhdmUgYW4gdW5yZWxlYXNlZCBzdGF0aWMgY2hlY2tlciB3YXJuaW5nIHNwZWNpZmljIGZvciB0
aGF0LgpUaGlzIGxpbmUgdHJpZ2dlcnMgdGhyZWUgd2FybmluZ3MgZm9yIG1lIG9uIG15IHVucmVs
ZWFzZWQgY29kZToKCmRyaXZlcnMvZ3B1L2RybS9kcm1fZHVtYl9idWZmZXJzLmM6NjkgZHJtX21v
ZGVfY3JlYXRlX2R1bWJfaW9jdGwoKSB3YXJuOiBuZWdhdGl2ZSB1c2VyIHN1YnRyYWN0OiAwLXUz
Mm1heCAtIDEKZHJpdmVycy9ncHUvZHJtL2RybV9kdW1iX2J1ZmZlcnMuYzo2OSBkcm1fbW9kZV9j
cmVhdGVfZHVtYl9pb2N0bCgpIHdhcm46IHBvdGVudGlhbCBpbnRlZ2VyIG92ZXJmbG93IGZyb20g
dXNlciAnKGFyZ3MtPmJwcCkgKyAoOCknCmRyaXZlcnMvZ3B1L2RybS9kcm1fZHVtYl9idWZmZXJz
LmM6NjkgZHJtX21vZGVfY3JlYXRlX2R1bWJfaW9jdGwoKSB3YXJuOiBwb3RlbnRpYWwgaW50ZWdl
ciBvdmVyZmxvdyBpbiAnRElWX1JPVU5EX1VQJwoKSXQncyBhIHByZXR0eSBjb21tb24gaWRpb20g
aW4gdGhlIGtlcm5lbCB0byBvdmVyZmxvdyBhbmQgdGhlbiB0ZXN0IGZvcgppdCBsYXRlciBzbyBJ
J20gbm90IGFibGUgdG8gcmVsZWFzZSB0aGlzIGNvZGUgYmVjYXVzZSBvZiB0aGUgbnVtYmVyIG9m
CmZhbHNlIHBvc2l0aXZlcyB0aGF0IHRoaXMgaWRpb20gY2F1c2VzLi4uCgpkaWZmIC0tZ2l0IGEv
ZHJpdmVycy9ncHUvZHJtL2RybV9kdW1iX2J1ZmZlcnMuYyBiL2RyaXZlcnMvZ3B1L2RybS9kcm1f
ZHVtYl9idWZmZXJzLmMKaW5kZXggMzlhYzE1Y2U0NzAyLi40NWIwYjViYmI1ZjggMTAwNjQ0Ci0t
LSBhL2RyaXZlcnMvZ3B1L2RybS9kcm1fZHVtYl9idWZmZXJzLmMKKysrIGIvZHJpdmVycy9ncHUv
ZHJtL2RybV9kdW1iX2J1ZmZlcnMuYwpAQCAtNjUsNyArNjUsOCBAQCBpbnQgZHJtX21vZGVfY3Jl
YXRlX2R1bWJfaW9jdGwoc3RydWN0IGRybV9kZXZpY2UgKmRldiwKIAkJcmV0dXJuIC1FSU5WQUw7
CiAKIAkvKiBvdmVyZmxvdyBjaGVja3MgZm9yIDMyYml0IHNpemUgY2FsY3VsYXRpb25zICovCi0J
LyogTk9URTogRElWX1JPVU5EX1VQKCkgY2FuIG92ZXJmbG93ICovCisJaWYgKGFyZ3MtPmJwcCA+
IFVJTlRfTUFYIC0gOCkKKwkJcmV0dXJuIC1FSU5WQUw7CiAJY3BwID0gRElWX1JPVU5EX1VQKGFy
Z3MtPmJwcCwgOCk7CiAJaWYgKCFjcHAgfHwgY3BwID4gMHhmZmZmZmZmZlUgLyBhcmdzLT53aWR0
aCkKIAkJcmV0dXJuIC1FSU5WQUw7Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fCmRyaS1kZXZlbCBtYWlsaW5nIGxpc3QKZHJpLWRldmVsQGxpc3RzLmZyZWVk
ZXNrdG9wLm9yZwpodHRwczovL2xpc3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZv
L2RyaS1kZXZlbAo=