From mboxrd@z Thu Jan  1 00:00:00 1970
From: Daniel Vetter <daniel@ffwll.ch>
Subject: Re: [PATCH] drm/dumb-buffers: Integer overflow in
 drm_mode_create_ioctl()
Date: Wed, 9 May 2018 10:23:07 +0200
Message-ID: <20180509082307.GS28661@phenom.ffwll.local>
References: <20180509072249.GA12754@mwanda>
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Return-path: <dri-devel-bounces@lists.freedesktop.org>
Received: from mail-wm0-x243.google.com (mail-wm0-x243.google.com
 [IPv6:2a00:1450:400c:c09::243])
 by gabe.freedesktop.org (Postfix) with ESMTPS id 81BAF6ECA5
 for <dri-devel@lists.freedesktop.org>; Wed,  9 May 2018 08:23:12 +0000 (UTC)
Received: by mail-wm0-x243.google.com with SMTP id o78-v6so26096423wmg.0
 for <dri-devel@lists.freedesktop.org>; Wed, 09 May 2018 01:23:12 -0700 (PDT)
Content-Disposition: inline
In-Reply-To: <20180509072249.GA12754@mwanda>
List-Unsubscribe: <https://lists.freedesktop.org/mailman/options/dri-devel>,
 <mailto:dri-devel-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <https://lists.freedesktop.org/archives/dri-devel>
List-Post: <mailto:dri-devel@lists.freedesktop.org>
List-Help: <mailto:dri-devel-request@lists.freedesktop.org?subject=help>
List-Subscribe: <https://lists.freedesktop.org/mailman/listinfo/dri-devel>,
 <mailto:dri-devel-request@lists.freedesktop.org?subject=subscribe>
Errors-To: dri-devel-bounces@lists.freedesktop.org
Sender: "dri-devel" <dri-devel-bounces@lists.freedesktop.org>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: David Airlie <airlied@linux.ie>, kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org
List-Id: dri-devel@lists.freedesktop.org

T24gV2VkLCBNYXkgMDksIDIwMTggYXQgMTA6MjI6NDlBTSArMDMwMCwgRGFuIENhcnBlbnRlciB3
cm90ZToKPiBUaGVyZSBpcyBhIGNvbW1lbnQgaGVyZSB3aGljaCBzYXlzIHRoYXQgRElWX1JPVU5E
X1VQKCkgYW5kIHRoYXQncyB3aGVyZQo+IHRoZSBwcm9ibGVtIGNvbWVzIGZyb20uICBTYXkgeW91
IHBpY2s6Cj4gCj4gCWFyZ3MtPmJwcCA9IFVJTlRfTUFYIC0gNzsKPiAJYXJncy0+d2lkdGggPSA0
Owo+IAlhcmdzLT5oZWlnaHQgPSAxOwo+IAo+IFRoZSBpbnRlZ2VyIG92ZXJmbG93IGluIERJVl9S
T1VORF9VUCgpIG1lYW5zICJjcHAiIGlzIFVJTlRfTUFYIC8gOCBhbmQKPiBiZWNhdXNlIG9mIGhv
dyB3ZSBwaWNrZWQgYXJncy0+d2lkdGggdGhhdCBtZWFucyBjcHAgPCBVSU5UX01BWCAvIDQuCj4g
Cj4gU2lnbmVkLW9mZi1ieTogRGFuIENhcnBlbnRlciA8ZGFuLmNhcnBlbnRlckBvcmFjbGUuY29t
Pgo+IC0tLQo+IEJ0dywgRElWX1JPVU5EX1VQKCkgaW50ZWdlciBvdmVyZmxvd3MgaGF2ZSBiZWVu
IGEgcmVjdXJyaW5nIHNvdXJjZSBvZgo+IGJ1Z3Mgc28gSSBoYXZlIGFuIHVucmVsZWFzZWQgc3Rh
dGljIGNoZWNrZXIgd2FybmluZyBzcGVjaWZpYyBmb3IgdGhhdC4KPiBUaGlzIGxpbmUgdHJpZ2dl
cnMgdGhyZWUgd2FybmluZ3MgZm9yIG1lIG9uIG15IHVucmVsZWFzZWQgY29kZToKPiAKPiBkcml2
ZXJzL2dwdS9kcm0vZHJtX2R1bWJfYnVmZmVycy5jOjY5IGRybV9tb2RlX2NyZWF0ZV9kdW1iX2lv
Y3RsKCkgd2FybjogbmVnYXRpdmUgdXNlciBzdWJ0cmFjdDogMC11MzJtYXggLSAxCj4gZHJpdmVy
cy9ncHUvZHJtL2RybV9kdW1iX2J1ZmZlcnMuYzo2OSBkcm1fbW9kZV9jcmVhdGVfZHVtYl9pb2N0
bCgpIHdhcm46IHBvdGVudGlhbCBpbnRlZ2VyIG92ZXJmbG93IGZyb20gdXNlciAnKGFyZ3MtPmJw
cCkgKyAoOCknCj4gZHJpdmVycy9ncHUvZHJtL2RybV9kdW1iX2J1ZmZlcnMuYzo2OSBkcm1fbW9k
ZV9jcmVhdGVfZHVtYl9pb2N0bCgpIHdhcm46IHBvdGVudGlhbCBpbnRlZ2VyIG92ZXJmbG93IGlu
ICdESVZfUk9VTkRfVVAnCj4gCj4gSXQncyBhIHByZXR0eSBjb21tb24gaWRpb20gaW4gdGhlIGtl
cm5lbCB0byBvdmVyZmxvdyBhbmQgdGhlbiB0ZXN0IGZvcgo+IGl0IGxhdGVyIHNvIEknbSBub3Qg
YWJsZSB0byByZWxlYXNlIHRoaXMgY29kZSBiZWNhdXNlIG9mIHRoZSBudW1iZXIgb2YKPiBmYWxz
ZSBwb3NpdGl2ZXMgdGhhdCB0aGlzIGlkaW9tIGNhdXNlcy4uLgo+IAo+IGRpZmYgLS1naXQgYS9k
cml2ZXJzL2dwdS9kcm0vZHJtX2R1bWJfYnVmZmVycy5jIGIvZHJpdmVycy9ncHUvZHJtL2RybV9k
dW1iX2J1ZmZlcnMuYwo+IGluZGV4IDM5YWMxNWNlNDcwMi4uNDViMGI1YmJiNWY4IDEwMDY0NAo+
IC0tLSBhL2RyaXZlcnMvZ3B1L2RybS9kcm1fZHVtYl9idWZmZXJzLmMKPiArKysgYi9kcml2ZXJz
L2dwdS9kcm0vZHJtX2R1bWJfYnVmZmVycy5jCj4gQEAgLTY1LDcgKzY1LDggQEAgaW50IGRybV9t
b2RlX2NyZWF0ZV9kdW1iX2lvY3RsKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYsCj4gIAkJcmV0dXJu
IC1FSU5WQUw7Cj4gIAo+ICAJLyogb3ZlcmZsb3cgY2hlY2tzIGZvciAzMmJpdCBzaXplIGNhbGN1
bGF0aW9ucyAqLwo+IC0JLyogTk9URTogRElWX1JPVU5EX1VQKCkgY2FuIG92ZXJmbG93ICovCj4g
KwlpZiAoYXJncy0+YnBwID4gVUlOVF9NQVggLSA4KQo+ICsJCXJldHVybiAtRUlOVkFMOwo+ICAJ
Y3BwID0gRElWX1JPVU5EX1VQKGFyZ3MtPmJwcCwgOCk7Cj4gIAlpZiAoIWNwcCB8fCBjcHAgPiAw
eGZmZmZmZmZmVSAvIGFyZ3MtPndpZHRoKQoKVGhlICFjcHAgY2hlY2sgaXMgbm93IHJlZHVuZGFu
dCwgdGhpcyB3YXMgb3VyIG1pbmltYWwgb3ZlcmZsb3cgY2hlY2suIE5vdGUKdGhhdCB3ZSBvbmx5
IHJlYWxseSBjYXJlIGZvciBjcHAgIT0gMCBhbmQgdGhhdCB0aGUgc2l6ZSBjYWxjdWxhdGlvbiBk
b2Vzbid0Cm92ZXJmbG93LiBVc2Vyc3BhY2Ugc3BlY2lmeWluZyBhIGNvbXBsZXRlbHkgYm9ndXMg
YnBwIHZhbHVlIGlzIG9rCm90aGVyd2lzZSAocmVhc29uYWJsZSB2YWx1ZXMgb25seSBnbyB1cCB0
byBhYm91dCAxMjgpLiBTbyBJIHRoaW5rIHRoZXJlJ3MKbm8gc2VjdXJpdHkgaXNzdWUgaGVyZS4K
CkFueXdheSwgY2FuIHlvdSBwbHMgcmVzcGluIHdpdGggdGhlICFjcHAgY2hlY2sgcmVtb3ZlZD8g
U2VlIGFsc28KCmNvbW1pdCA2YTc3ZTgwZTU1Y2FjYWNlNjBmZjAzYWE3MTdhNmQzNjRhNDAxZDJi
IChIRUFEIC0+IHN0dWZmKQpBdXRob3I6IERhbmllbCBWZXR0ZXIgPGRhbmllbC52ZXR0ZXJAZmZ3
bGwuY2g+CkRhdGU6ICAgTW9uIEFwciAzMCAxNzowNDoxMCAyMDE4ICswMjAwCgogICAgYmFja2xp
Z2h0OiByZW1vdmUgb2Jzb2xldGUgY29tbWVudCBmb3IgLT5zdGF0ZQoKZm9yIGNvbnRleHQuCgpU
aGFua3MsIERhbmllbAoKPiAgCQlyZXR1cm4gLUVJTlZBTDsKPiBfX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fXwo+IGRyaS1kZXZlbCBtYWlsaW5nIGxpc3QKPiBk
cmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCj4gaHR0cHM6Ly9saXN0cy5mcmVlZGVza3Rv
cC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwKCi0tIApEYW5pZWwgVmV0dGVyClNvZnR3
YXJlIEVuZ2luZWVyLCBJbnRlbCBDb3Jwb3JhdGlvbgpodHRwOi8vYmxvZy5mZndsbC5jaApfX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpkcmktZGV2ZWwgbWFp
bGluZyBsaXN0CmRyaS1kZXZlbEBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0cHM6Ly9saXN0cy5m
cmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwK