Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a5cd3351 authored by Xi Wang's avatar Xi Wang Committed by Dave Airlie
Browse files

drm: integer overflow in drm_mode_dirtyfb_ioctl() 



There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips.  The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result
in a memory corruption.

Reported-by: default avatarHaogang Chen <haogangchen@gmail.com>
Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
Cc: stable@kernel.org
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent c916874d

drivers/gpu/drm/drm_crtc.c

+4 −0
Original line number Diff line number Diff line
@@ -1873,6 +1873,10 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev, 
	}



	if (num_clips && clips_ptr) {

		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {

			ret = -EINVAL;

			goto out_err1;

		}

		clips = kzalloc(num_clips * sizeof(*clips), GFP_KERNEL);

		if (!clips) {

			ret = -ENOMEM;

include/drm/drm_mode.h

+2 −0
Original line number Diff line number Diff line
@@ -235,6 +235,8 @@ struct drm_mode_fb_cmd { 
#define DRM_MODE_FB_DIRTY_ANNOTATE_FILL 0x02

#define DRM_MODE_FB_DIRTY_FLAGS         0x03



#define DRM_MODE_FB_DIRTY_MAX_CLIPS     256



/*

 * Mark a region of a framebuffer as dirty.

 *