From: Murray McAllister Date: Mon, 27 Mar 2017 09:12:53 +0000 (+0200) Subject: drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() X-Git-Tag: Ubuntu-4.10.0-21.23~135 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=00288b9e043eb5a5a34074bb7c416b2cfb5cae3e;p=mirror_ubuntu-artful-kernel.git drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() BugLink: http://bugs.launchpad.net/bugs/1682130 commit 36274ab8c596f1240c606bb514da329add2a1bcd upstream. Before memory allocations vmw_surface_define_ioctl() checks the upper-bounds of a user-supplied size, but does not check if the supplied size is 0. Add check to avoid NULL pointer dereferences. Signed-off-by: Murray McAllister Reviewed-by: Sinclair Yeh Signed-off-by: Greg Kroah-Hartman Signed-off-by: Tim Gardner --- diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index b445ce9b9757..f410502cb075 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -716,8 +716,8 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data, for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) num_sizes += req->mip_levels[i]; - if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * - DRM_VMW_MAX_MIP_LEVELS) + if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS || + num_sizes == 0) return -EINVAL; size = vmw_user_surface_size + 128 +