From patchwork Fri Jan 18 12:20:20 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 10769943 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id DD0E51390 for ; Fri, 18 Jan 2019 12:21:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CAE992E521 for ; Fri, 18 Jan 2019 12:21:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id BEEB92E6CE; Fri, 18 Jan 2019 12:21:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 7A91A2E521 for ; Fri, 18 Jan 2019 12:21:35 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 6423C6F756; Fri, 18 Jan 2019 12:20:40 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by gabe.freedesktop.org (Postfix) with ESMTPS id B8EB36F752; Fri, 18 Jan 2019 12:20:36 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 1D3862DACFE; Fri, 18 Jan 2019 12:20:36 +0000 (UTC) Received: from sirius.home.kraxel.org (ovpn-116-38.ams2.redhat.com [10.36.116.38]) by smtp.corp.redhat.com (Postfix) with ESMTP id 812E5600C2; Fri, 18 Jan 2019 12:20:28 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id A454051B80; Fri, 18 Jan 2019 13:20:23 +0100 (CET) From: Gerd Hoffmann To: dri-devel@lists.freedesktop.org Subject: [PATCH v3 23/23] drm/qxl: add overflow checks to qxl_mode_dumb_create() Date: Fri, 18 Jan 2019 13:20:20 +0100 Message-Id: <20190118122020.27596-24-kraxel@redhat.com> In-Reply-To: <20190118122020.27596-1-kraxel@redhat.com> References: <20190118122020.27596-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Fri, 18 Jan 2019 12:20:36 +0000 (UTC) X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: David Airlie , open list , "open list:DRM DRIVER FOR QXL VIRTUAL GPU" , Gerd Hoffmann , "open list:DRM DRIVER FOR QXL VIRTUAL GPU" , Dave Airlie MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Signed-off-by: Gerd Hoffmann --- drivers/gpu/drm/qxl/qxl_dumb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c index 272d19b677..bed6d06ee4 100644 --- a/drivers/gpu/drm/qxl/qxl_dumb.c +++ b/drivers/gpu/drm/qxl/qxl_dumb.c @@ -37,11 +37,13 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, uint32_t handle; int r; struct qxl_surface surf; - uint32_t pitch, format; + uint32_t pitch, size, format; - pitch = args->width * ((args->bpp + 1) / 8); - args->size = pitch * args->height; - args->size = ALIGN(args->size, PAGE_SIZE); + if (check_mul_overflow(args->width, ((args->bpp + 1) / 8), &pitch)) + return -EINVAL; + if (check_mul_overflow(pitch, args->height, &size)) + return -EINVAL; + args->size = ALIGN(size, PAGE_SIZE); switch (args->bpp) { case 16: