| commit | ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf | [log] [tgz] |
|---|---|---|
| author | Vladis Dronov <vdronov@redhat.com> | Fri Jun 02 07:42:09 2017 +0200 |
| committer | Thomas Hellstrom <thellstrom@vmware.com> | Wed Jun 07 12:07:35 2017 +0200 |
| tree | b0ffe1b2073a8c749c18e9e99696df602f9637a0 | |
| parent | e5b4ab1ffbe2553ee278cb1b6bcb671a31d86518 [diff] |
drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is a user-controlled 'uint32_t' value which is used as a loop count limit. This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'. References: https://bugzilla.redhat.com/show_bug.cgi?id=1437431 Cc: <stable@vger.kernel.org> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Reviewed-by: Sinclair Yeh <syeh@vmware.com>