Cc'ed Dave's work email.
On Wed, Nov 23, 2011 at 2:12 PM, Xi Wang wrote:
> There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
> if userspace passes in a large num_clips. The call to kmalloc would
> allocate a small buffer, and the call to fb->funcs->dirty may result
> in a memory
Cc'ed Dave's work email.
On Wed, Nov 23, 2011 at 2:12 PM, Xi Wang wrote:
> There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
> if userspace passes in a large num_clips. ?The call to kmalloc would
> allocate a small buffer, and the call to fb->funcs->dirty may result
> in a memory
; > secur...@kernel.org, "Dave Airlie"
> > Sent: Wednesday, 14 December, 2011 1:16:49 PM
> > Subject: Re: [PATCH] drm: integer overflow in drm_mode_dirtyfb_ioctl()
> >
> > Cc'ed Dave's work email.
>
> This is already in Linus tree, went there a w
nel.org,
> > security at kernel.org, "Dave Airlie"
> > Sent: Wednesday, 14 December, 2011 1:16:49 PM
> > Subject: Re: [PATCH] drm: integer overflow in drm_mode_dirtyfb_ioctl()
> >
> > Cc'ed Dave's work email.
>
> This is already in Linus tree, went
- Original Message -
> From: "Eugene Teo"
> To: "Xi Wang"
> Cc: "David Airlie" , dri-devel at lists.freedesktop.org,
> linux-kernel at vger.kernel.org,
> security at kernel.org, "Dave Airlie"
> Sent: Wednesday, 14 December, 20
- Original Message -
> From: "Eugene Teo"
> To: "Xi Wang"
> Cc: "David Airlie" , dri-devel@lists.freedesktop.org,
> linux-ker...@vger.kernel.org,
> secur...@kernel.org, "Dave Airlie"
> Sent: Wednesday, 14 December, 2011
There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips. The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result
in a memory corruption.
Reported-by: Haogang Chen
Signed-off-by: Xi Wang
---
drivers/gpu/dr
There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips. The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result
in a memory corruption.
Reported-by: Haogang Chen
Signed-off-by: Xi Wang
---
drivers/gpu/dr
