Commit 63774069 authored Mar 27, 2017 by Murray McAllister Committed by Thomas Hellstrom Mar 30, 2017

drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()



In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is
used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()),
which can leak useful addresses to dmesg.

Add check to avoid a size of 0.

Cc: <stable@vger.kernel.org>
Signed-off-by: Murray McAllister <murray.mcallister@insomniasec.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>

parent 36274ab8

drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -186,7 +186,7 @@ int vmw_get_cap_3d_ioctl(struct drm_device dev, void data,
		bool gb_objects = !!(dev_priv->capabilities & SVGA_CAP_GBOBJECTS);
		struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);

		if (unlikely(arg->pad64 != 0)) {
		if (unlikely(arg->pad64 != 0 \|\| arg->max_size == 0)) {
		DRM_ERROR("Illegal GET_3D_CAP argument.\n");
		return -EINVAL;
		}