From: Murray McAllister Date: Sat, 25 Mar 2017 03:33:00 +0000 (-0700) Subject: vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() X-Git-Tag: archive/raspbian/4.15.4-1+rpi1~1^2^2^2^2^2^2^2^2^2^2^2^2^2^2~37 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=663f5e25dd9303417885ae76c87dd094c8b8ca97;p=linux.git vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Before memory allocations vmw_surface_define_ioctl() checks the upper-bounds of a user-supplied size, but does not check if the supplied size is 0. Add check to avoid NULL pointer dereferences. Signed-off-by: Murray McAllister Reviewed-by: Sinclair Yeh [bwh: Fix filename] Gbp-Pq: Topic bugfix/x86 Gbp-Pq: Name vmwgfx-null-pointer-dereference-in-vmw_surface_define_ioctl.patch --- diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index b445ce9b975..f410502cb07 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -716,8 +716,8 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data, for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) num_sizes += req->mip_levels[i]; - if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * - DRM_VMW_MAX_MIP_LEVELS) + if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS || + num_sizes == 0) return -EINVAL; size = vmw_user_surface_size + 128 +