From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel Vetter Subject: Re: [PATCH v2] drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl() Date: Wed, 16 May 2018 17:57:47 +0200 Message-ID: <20180516155747.GJ3438@phenom.ffwll.local> References: <152585393757.3513.738158010667924495@mail.alporthouse.com> <20180516140026.GA19340@mwanda> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail-wm0-x241.google.com (mail-wm0-x241.google.com [IPv6:2a00:1450:400c:c09::241]) by gabe.freedesktop.org (Postfix) with ESMTPS id DE5C16E2A9 for ; Wed, 16 May 2018 15:57:51 +0000 (UTC) Received: by mail-wm0-x241.google.com with SMTP id a8-v6so2743964wmg.5 for ; Wed, 16 May 2018 08:57:51 -0700 (PDT) Content-Disposition: inline In-Reply-To: <20180516140026.GA19340@mwanda> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: Dan Carpenter Cc: David Airlie , kernel-janitors@vger.kernel.org, dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org T24gV2VkLCBNYXkgMTYsIDIwMTggYXQgMDU6MDA6MjZQTSArMDMwMCwgRGFuIENhcnBlbnRlciB3 cm90ZToKPiBUaGVyZSBpcyBhIGNvbW1lbnQgaGVyZSB3aGljaCBzYXlzIHRoYXQgRElWX1JPVU5E X1VQKCkgYW5kIHRoYXQncyB3aGVyZQo+IHRoZSBwcm9ibGVtIGNvbWVzIGZyb20uICBTYXkgeW91 IHBpY2s6Cj4gCj4gCWFyZ3MtPmJwcCA9IFVJTlRfTUFYIC0gNzsKPiAJYXJncy0+d2lkdGggPSA0 Owo+IAlhcmdzLT5oZWlnaHQgPSAxOwo+IAo+IFRoZSBpbnRlZ2VyIG92ZXJmbG93IGluIERJVl9S T1VORF9VUCgpIG1lYW5zICJjcHAiIGlzIFVJTlRfTUFYIC8gOCBhbmQKPiBiZWNhdXNlIG9mIGhv dyB3ZSBwaWNrZWQgYXJncy0+d2lkdGggdGhhdCBtZWFucyBjcHAgPCBVSU5UX01BWCAvIDQuCj4g Cj4gSSd2ZSBmaXhlZCBpdCBieSBwcmV2ZW50aW5nIHRoZSBpbnRlZ2VyIG92ZXJmbG93IGluIERJ Vl9ST1VORF9VUCgpLiAgSQo+IHJlbW92ZWQgdGhlIGNoZWNrIGZvciAhY3BwIGJlY2F1c2UgaXQn cyBub3QgcG9zc2libGUgYWZ0ZXIgdGhpcyBjaGFuZ2UuCj4gSSBhbHNvIGNoYW5nZWQgYWxsIHRo ZSAweGZmZmZmZmZmVSByZWZlcmVuY2VzIHRvIFUzMl9NQVguCj4gCj4gU2lnbmVkLW9mZi1ieTog RGFuIENhcnBlbnRlciA8ZGFuLmNhcnBlbnRlckBvcmFjbGUuY29tPgo+IC0tLQo+IHYyOiAgYWRk aXRpb25hbCBjbGVhbnVwcwoKVGhhbmtzIGEgbG90IGZvciByZXNwaW5uaW5nLCBhcHBsaWVkIHRv IGRybS1taXNjLWZpeGVzLgotRGFuaWVsCgo+IAo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9k cm0vZHJtX2R1bWJfYnVmZmVycy5jIGIvZHJpdmVycy9ncHUvZHJtL2RybV9kdW1iX2J1ZmZlcnMu Ywo+IGluZGV4IDM5YWMxNWNlNDcwMi4uOWUyYWUwMmYzMWUwIDEwMDY0NAo+IC0tLSBhL2RyaXZl cnMvZ3B1L2RybS9kcm1fZHVtYl9idWZmZXJzLmMKPiArKysgYi9kcml2ZXJzL2dwdS9kcm0vZHJt X2R1bWJfYnVmZmVycy5jCj4gQEAgLTY1LDEyICs2NSwxMyBAQCBpbnQgZHJtX21vZGVfY3JlYXRl X2R1bWJfaW9jdGwoc3RydWN0IGRybV9kZXZpY2UgKmRldiwKPiAgCQlyZXR1cm4gLUVJTlZBTDsK PiAgCj4gIAkvKiBvdmVyZmxvdyBjaGVja3MgZm9yIDMyYml0IHNpemUgY2FsY3VsYXRpb25zICov Cj4gLQkvKiBOT1RFOiBESVZfUk9VTkRfVVAoKSBjYW4gb3ZlcmZsb3cgKi8KPiArCWlmIChhcmdz LT5icHAgPiBVMzJfTUFYIC0gOCkKPiArCQlyZXR1cm4gLUVJTlZBTDsKPiAgCWNwcCA9IERJVl9S T1VORF9VUChhcmdzLT5icHAsIDgpOwo+IC0JaWYgKCFjcHAgfHwgY3BwID4gMHhmZmZmZmZmZlUg LyBhcmdzLT53aWR0aCkKPiArCWlmIChjcHAgPiBVMzJfTUFYIC8gYXJncy0+d2lkdGgpCj4gIAkJ cmV0dXJuIC1FSU5WQUw7Cj4gIAlzdHJpZGUgPSBjcHAgKiBhcmdzLT53aWR0aDsKPiAtCWlmIChh cmdzLT5oZWlnaHQgPiAweGZmZmZmZmZmVSAvIHN0cmlkZSkKPiArCWlmIChhcmdzLT5oZWlnaHQg PiBVMzJfTUFYIC8gc3RyaWRlKQo+ICAJCXJldHVybiAtRUlOVkFMOwo+ICAKPiAgCS8qIHRlc3Qg Zm9yIHdyYXAtYXJvdW5kICovCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18KPiBkcmktZGV2ZWwgbWFpbGluZyBsaXN0Cj4gZHJpLWRldmVsQGxpc3RzLmZy ZWVkZXNrdG9wLm9yZwo+IGh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlz dGluZm8vZHJpLWRldmVsCgotLSAKRGFuaWVsIFZldHRlcgpTb2Z0d2FyZSBFbmdpbmVlciwgSW50 ZWwgQ29ycG9yYXRpb24KaHR0cDovL2Jsb2cuZmZ3bGwuY2gKX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2 ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21h aWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg==