summaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/shmobile
diff options
context:
space:
mode:
authorJoonyoung Shim <jy0922.shim@samsung.com>2017-01-23 10:13:54 +0100
committerInki Dae <inki.dae@samsung.com>2017-01-31 00:50:35 +0100
commite41456bfc811f12b5dcda6f2d6849bdff68f6c0a (patch)
tree4403954b52737f4e9a46bc746859a0109b766af0 /drivers/gpu/drm/shmobile
parentdrm/exynos: fix a timeout loop (diff)
downloadlinux-e41456bfc811f12b5dcda6f2d6849bdff68f6c0a.tar.xz
linux-e41456bfc811f12b5dcda6f2d6849bdff68f6c0a.zip
drm/exynos: g2d: prevent integer overflow in
The size computations done in the ioctl function use an integer. If userspace submits a request with req->cmd_nr or req->cmd_buf_nr set to INT_MAX, the integer computations overflow later, leading to potential (kernel) memory corruption. Prevent this issue by enforcing a limit on the number of submitted commands, so that we have enough headroom later for the size computations. Note that this change has no impact on the currently available users in userspace, like e.g. libdrm/exynos. While at it, also make a comment about the size computation more detailed. Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com> Signed-off-by: Tobias Jakobi <tjakobi@math.uni-bielefeld.de> Signed-off-by: Inki Dae <inki.dae@samsung.com>
Diffstat (limited to 'drivers/gpu/drm/shmobile')
0 files changed, 0 insertions, 0 deletions