diff options
| author | Vladis Dronov <vdronov@redhat.com> | 2017-06-02 08:42:09 +0300 |
|---|---|---|
| committer | Thomas Hellstrom <thellstrom@vmware.com> | 2017-06-07 13:07:35 +0300 |
| commit | ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf (patch) | |
| tree | b0ffe1b2073a8c749c18e9e99696df602f9637a0 /tools | |
| parent | e5b4ab1ffbe2553ee278cb1b6bcb671a31d86518 (diff) | |
| download | linux-ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf.tar.xz | |
drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()
The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is
a user-controlled 'uint32_t' value which is used as a loop count limit.
This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'.
References:
https://bugzilla.redhat.com/show_bug.cgi?id=1437431
Cc: <stable@vger.kernel.org>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Diffstat (limited to 'tools')
0 files changed, 0 insertions, 0 deletions