* [patch 4/4 v2] drm/qxl: integer overflow in qxl_alloc_surf_ioctl() [not found] <421515033.28673933.1442569564307.JavaMail.zimbra@redhat.com> @ 2015-09-22 14:32 ` Dan Carpenter 2015-09-23 10:45 ` Frediano Ziglio 0 siblings, 1 reply; 2+ messages in thread From: Dan Carpenter @ 2015-09-22 14:32 UTC (permalink / raw) To: David Airlie; +Cc: Dave Airlie, kernel-janitors, dri-devel, Frediano Ziglio The size calculation can overflow. I don't know if this leads to memory corruption, but it causes a static checker warning. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- v2: I don't know think the size is capped anywhere. In my first version of this patch, I introduced a divide by zero bug. diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index b2db482..49b3158 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -396,12 +396,14 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev, void *data, struct qxl_bo *qobj; int handle; int ret; - int size, actual_stride; + u64 size, actual_stride; struct qxl_surface surf; /* work out size allocate bo with handle */ actual_stride = param->stride < 0 ? -param->stride : param->stride; size = actual_stride * param->height + actual_stride; + if (size > INT_MAX) + return -EINVAL; surf.format = param->format; surf.width = param->width; ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [patch 4/4 v2] drm/qxl: integer overflow in qxl_alloc_surf_ioctl() 2015-09-22 14:32 ` [patch 4/4 v2] drm/qxl: integer overflow in qxl_alloc_surf_ioctl() Dan Carpenter @ 2015-09-23 10:45 ` Frediano Ziglio 0 siblings, 0 replies; 2+ messages in thread From: Frediano Ziglio @ 2015-09-23 10:45 UTC (permalink / raw) To: Dan Carpenter; +Cc: Dave Airlie, kernel-janitors, dri-devel > > The size calculation can overflow. I don't know if this leads to > memory corruption, but it causes a static checker warning. > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > v2: I don't know think the size is capped anywhere. In my first version > of this patch, I introduced a divide by zero bug. > Beside the second sentence I would ack Frediano > diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c > b/drivers/gpu/drm/qxl/qxl_ioctl.c > index b2db482..49b3158 100644 > --- a/drivers/gpu/drm/qxl/qxl_ioctl.c > +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c > @@ -396,12 +396,14 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev, > void *data, > struct qxl_bo *qobj; > int handle; > int ret; > - int size, actual_stride; > + u64 size, actual_stride; > struct qxl_surface surf; > > /* work out size allocate bo with handle */ > actual_stride = param->stride < 0 ? -param->stride : param->stride; > size = actual_stride * param->height + actual_stride; > + if (size > INT_MAX) > + return -EINVAL; > > surf.format = param->format; > surf.width = param->width; > ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-09-23 10:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <421515033.28673933.1442569564307.JavaMail.zimbra@redhat.com>
2015-09-22 14:32 ` [patch 4/4 v2] drm/qxl: integer overflow in qxl_alloc_surf_ioctl() Dan Carpenter
2015-09-23 10:45 ` Frediano Ziglio
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox