* [patch 4/4 v2] drm/qxl: integer overflow in qxl_alloc_surf_ioctl()
[not found] <421515033.28673933.1442569564307.JavaMail.zimbra@redhat.com>
@ 2015-09-22 14:32 ` Dan Carpenter
2015-09-23 10:45 ` Frediano Ziglio
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2015-09-22 14:32 UTC (permalink / raw)
To: David Airlie; +Cc: Dave Airlie, kernel-janitors, dri-devel, Frediano Ziglio
The size calculation can overflow. I don't know if this leads to
memory corruption, but it causes a static checker warning.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: I don't know think the size is capped anywhere. In my first version
of this patch, I introduced a divide by zero bug.
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index b2db482..49b3158 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -396,12 +396,14 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev, void *data,
struct qxl_bo *qobj;
int handle;
int ret;
- int size, actual_stride;
+ u64 size, actual_stride;
struct qxl_surface surf;
/* work out size allocate bo with handle */
actual_stride = param->stride < 0 ? -param->stride : param->stride;
size = actual_stride * param->height + actual_stride;
+ if (size > INT_MAX)
+ return -EINVAL;
surf.format = param->format;
surf.width = param->width;
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch 4/4 v2] drm/qxl: integer overflow in qxl_alloc_surf_ioctl()
2015-09-22 14:32 ` [patch 4/4 v2] drm/qxl: integer overflow in qxl_alloc_surf_ioctl() Dan Carpenter
@ 2015-09-23 10:45 ` Frediano Ziglio
0 siblings, 0 replies; 2+ messages in thread
From: Frediano Ziglio @ 2015-09-23 10:45 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Dave Airlie, kernel-janitors, dri-devel
>
> The size calculation can overflow. I don't know if this leads to
> memory corruption, but it causes a static checker warning.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> v2: I don't know think the size is capped anywhere. In my first version
> of this patch, I introduced a divide by zero bug.
>
Beside the second sentence I would ack
Frediano
> diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c
> b/drivers/gpu/drm/qxl/qxl_ioctl.c
> index b2db482..49b3158 100644
> --- a/drivers/gpu/drm/qxl/qxl_ioctl.c
> +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
> @@ -396,12 +396,14 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev,
> void *data,
> struct qxl_bo *qobj;
> int handle;
> int ret;
> - int size, actual_stride;
> + u64 size, actual_stride;
> struct qxl_surface surf;
>
> /* work out size allocate bo with handle */
> actual_stride = param->stride < 0 ? -param->stride : param->stride;
> size = actual_stride * param->height + actual_stride;
> + if (size > INT_MAX)
> + return -EINVAL;
>
> surf.format = param->format;
> surf.width = param->width;
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-09-23 10:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <421515033.28673933.1442569564307.JavaMail.zimbra@redhat.com>
2015-09-22 14:32 ` [patch 4/4 v2] drm/qxl: integer overflow in qxl_alloc_surf_ioctl() Dan Carpenter
2015-09-23 10:45 ` Frediano Ziglio
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox