From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B0F1C43603 for ; Wed, 11 Dec 2019 15:09:21 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3D45524656 for ; Wed, 11 Dec 2019 15:09:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1576076961; bh=W0VANgufBlokocbYrRF/dsFVIFjy6aAmV9Ao17Jfg4U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=LRjy5SRYjdTSVy3CgyCQ792ia7OrOw+se0wo7ec7PMqrPuSG6SZXWsz89HpizoCfr pOEL+QIgTStiNPopZM+dE7V7DglBEooFmloct4i5jIc5mwv/Rg0xOnSR3da1rq/i18 4PeVU6+24zwglW+G3qO7tgb/OfwRXFVpyI6Nh0yM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730573AbfLKPJU (ORCPT ); Wed, 11 Dec 2019 10:09:20 -0500 Received: from mail.kernel.org ([198.145.29.99]:57242 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729481AbfLKPJS (ORCPT ); Wed, 11 Dec 2019 10:09:18 -0500 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D1EF92464B; Wed, 11 Dec 2019 15:09:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1576076958; bh=W0VANgufBlokocbYrRF/dsFVIFjy6aAmV9Ao17Jfg4U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=si1mhh958vUVvVscgQTW5fgwDMKJdgy/8eDMFmqk2ogrjF2iuYB1lE/T8oPlkDsb9 +MyXM0T8rVIrhfr+aVunJWzuk2RWxyxqlV4ZGtjG8zYCoqvqvaGm3BbEmeJu2f1lhY oy6aAdVJi0NKBgAID9EfiS6rcnv8qylypSEQf/2A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Chris Wilson Subject: [PATCH 5.4 56/92] drm/i810: Prevent underflow in ioctl Date: Wed, 11 Dec 2019 16:05:47 +0100 Message-Id: <20191211150247.145887780@linuxfoundation.org> X-Mailer: git-send-email 2.24.1 In-Reply-To: <20191211150221.977775294@linuxfoundation.org> References: <20191211150221.977775294@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dan Carpenter commit 4f69851fbaa26b155330be35ce8ac393e93e7442 upstream. The "used" variables here come from the user in the ioctl and it can be negative. It could result in an out of bounds write. Signed-off-by: Dan Carpenter Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i810/i810_dma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/gpu/drm/i810/i810_dma.c +++ b/drivers/gpu/drm/i810/i810_dma.c @@ -728,7 +728,7 @@ static void i810_dma_dispatch_vertex(str if (nbox > I810_NR_SAREA_CLIPRECTS) nbox = I810_NR_SAREA_CLIPRECTS; - if (used > 4 * 1024) + if (used < 0 || used > 4 * 1024) used = 0; if (sarea_priv->dirty) @@ -1048,7 +1048,7 @@ static void i810_dma_dispatch_mc(struct if (u != I810_BUF_CLIENT) DRM_DEBUG("MC found buffer that isn't mine!\n"); - if (used > 4 * 1024) + if (used < 0 || used > 4 * 1024) used = 0; sarea_priv->dirty = 0x7f;