Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752935AbdDDJne (ORCPT ); Tue, 4 Apr 2017 05:43:34 -0400 Received: from mx1.redhat.com ([209.132.183.28]:51304 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751130AbdDDJnd (ORCPT ); Tue, 4 Apr 2017 05:43:33 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com E59EA81F07 Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=vdronov@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com E59EA81F07 Date: Tue, 4 Apr 2017 05:43:30 -0400 (EDT) From: Vladis Dronov To: Sinclair Yeh Cc: VMware Graphics , Thomas Hellstrom , David Airlie , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Message-ID: <1482987345.10707415.1491299010939.JavaMail.zimbra@redhat.com> In-Reply-To: <20170331150712.GB33594@syeh-m02> References: <20170330102712.3123-1-vdronov@redhat.com> <20170331150712.GB33594@syeh-m02> Subject: Re: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [10.40.1.12] Thread-Topic: kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() Thread-Index: U8wKF1cKqHasQ79LuFYXNdxa5NPlPA== X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Tue, 04 Apr 2017 09:43:33 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2348 Lines: 61 Hello, Sinclair! > Here, the check should be "> DRM_VMW_MAX_MIP_LEVELS" because req->mip_levels > is only for one layer. Got it, thanks! > Also, as long as we can doing a check, I would suggest we check for 0 as > well. Do you mean a check for "req->mip_levels > 0" or for "req->mip_levels >= 0" ? I glimpsed thru the code and I do not see problems with req->mip_levels being 0, surely I may be mistaking. Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer ----- Original Message ----- From: "Sinclair Yeh" To: "Vladis Dronov" Cc: "VMware Graphics" , "Thomas Hellstrom" , "David Airlie" , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Sent: Friday, March 31, 2017 5:07:12 PM Subject: Re: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() Hi Vladis, On Thu, Mar 30, 2017 at 12:27:12PM +0200, Vladis Dronov wrote: > The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is > a user-controlled 'uint32_t' value which is used as a loop count limit. > This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'. > > References: > https://urldefense.proofpoint.com/v2/url?u=https-3A__bugzilla.redhat.com_show-5Fbug.cgi-3Fid-3D1437431&d=DwIBAg&c=uilaK90D4TOVoH58JNXRgQ&r=HaJ2a6NYExoV0cntAYcoqA&m=5yR87BuuU86aoAjCveInxh6jvgOyumqIHQhTs0xLo38&s=tWQs7vwNLgD_b2RWMddVtusEKh9FQTIF5rKFOWudslE&e= > Signed-off-by: Vladis Dronov > --- > drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c > index b445ce9..b30824b 100644 > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c > @@ -1281,6 +1281,10 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, > if (req->multisample_count != 0) > return -EINVAL; > > + if (req->mip_levels > DRM_VMW_MAX_SURFACE_FACES * > + DRM_VMW_MAX_MIP_LEVELS) > + return -EINVAL; > + Here, the check should be "> DRM_VMW_MAX_MIP_LEVELS" because req->mip_levels is only for one layer. Also, as long as we can doing a check, I would suggest we check for 0 as well. Sinclair