From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754666AbdCaKrc (ORCPT ); Fri, 31 Mar 2017 06:47:32 -0400 Received: from mx1.redhat.com ([209.132.183.28]:52906 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753828AbdCaKrb (ORCPT ); Fri, 31 Mar 2017 06:47:31 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 4A7FAB0402 Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=vdronov@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 4A7FAB0402 Date: Fri, 31 Mar 2017 06:47:30 -0400 (EDT) From: Vladis Dronov To: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Message-ID: <736013744.9705201.1490957250099.JavaMail.zimbra@redhat.com> In-Reply-To: <20170330102712.3123-1-vdronov@redhat.com> References: <20170330102712.3123-1-vdronov@redhat.com> Subject: Re: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [10.40.1.12] Thread-Topic: kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() Thread-Index: I/gEF03MYQg0rgMfzTdRMaRDtnSE7g== X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Fri, 31 Mar 2017 10:47:30 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This flaw was assigned an id CVE-2017-7346 by MITRE: http://seclists.org/oss-sec/2017/q1/696 Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer ----- Original Message ----- From: "Vladis Dronov" To: "VMware Graphics" , "Sinclair Yeh" , "Thomas Hellstrom" , "David Airlie" , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: "Vladis Dronov" Sent: Thursday, March 30, 2017 12:27:12 PM Subject: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is a user-controlled 'uint32_t' value which is used as a loop count limit. This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'. References: https://bugzilla.redhat.com/show_bug.cgi?id=1437431 Signed-off-by: Vladis Dronov From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vladis Dronov Subject: Re: [PATCH] kernel: drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() Date: Fri, 31 Mar 2017 06:47:30 -0400 (EDT) Message-ID: <736013744.9705201.1490957250099.JavaMail.zimbra@redhat.com> References: <20170330102712.3123-1-vdronov@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by gabe.freedesktop.org (Postfix) with ESMTPS id C34B16EA7D for ; Fri, 31 Mar 2017 10:47:30 +0000 (UTC) In-Reply-To: <20170330102712.3123-1-vdronov@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org List-Id: dri-devel@lists.freedesktop.org VGhpcyBmbGF3IHdhcyBhc3NpZ25lZCBhbiBpZCBDVkUtMjAxNy03MzQ2IGJ5IE1JVFJFOgoKaHR0 cDovL3NlY2xpc3RzLm9yZy9vc3Mtc2VjLzIwMTcvcTEvNjk2CgpCZXN0IHJlZ2FyZHMsClZsYWRp cyBEcm9ub3YgfCBSZWQgSGF0LCBJbmMuIHwgUHJvZHVjdCBTZWN1cml0eSBFbmdpbmVlcgoKLS0t LS0gT3JpZ2luYWwgTWVzc2FnZSAtLS0tLQpGcm9tOiAiVmxhZGlzIERyb25vdiIgPHZkcm9ub3ZA cmVkaGF0LmNvbT4KVG86ICJWTXdhcmUgR3JhcGhpY3MiIDxsaW51eC1ncmFwaGljcy1tYWludGFp bmVyQHZtd2FyZS5jb20+LCAiU2luY2xhaXIgWWVoIiA8c3llaEB2bXdhcmUuY29tPiwgIlRob21h cyBIZWxsc3Ryb20iIDx0aGVsbHN0cm9tQHZtd2FyZS5jb20+LCAiRGF2aWQgQWlybGllIiA8YWly bGllZEBsaW51eC5pZT4sIGRyaS1kZXZlbEBsaXN0cy5mcmVlZGVza3RvcC5vcmcsIGxpbnV4LWtl cm5lbEB2Z2VyLmtlcm5lbC5vcmcKQ2M6ICJWbGFkaXMgRHJvbm92IiA8dmRyb25vdkByZWRoYXQu Y29tPgpTZW50OiBUaHVyc2RheSwgTWFyY2ggMzAsIDIwMTcgMTI6Mjc6MTIgUE0KU3ViamVjdDog W1BBVENIXSBrZXJuZWw6IGRybS92bXdnZng6IGxpbWl0IHRoZSBudW1iZXIgb2YgbWlwIGxldmVs cyBpbiB2bXdfZ2Jfc3VyZmFjZV9kZWZpbmVfaW9jdGwoKQoKVGhlICdyZXEtPm1pcF9sZXZlbHMn IHBhcmFtZXRlciBpbiB2bXdfZ2Jfc3VyZmFjZV9kZWZpbmVfaW9jdGwoKSBpcwphIHVzZXItY29u dHJvbGxlZCAndWludDMyX3QnIHZhbHVlIHdoaWNoIGlzIHVzZWQgYXMgYSBsb29wIGNvdW50IGxp bWl0LgpUaGlzIGNhbiBsZWFkIHRvIGEga2VybmVsIGxvY2t1cCBhbmQgRG9TLiBBZGQgY2hlY2sg Zm9yICdyZXEtPm1pcF9sZXZlbHMnLgoKUmVmZXJlbmNlczoKaHR0cHM6Ly9idWd6aWxsYS5yZWRo YXQuY29tL3Nob3dfYnVnLmNnaT9pZD0xNDM3NDMxClNpZ25lZC1vZmYtYnk6IFZsYWRpcyBEcm9u b3YgPHZkcm9ub3ZAcmVkaGF0LmNvbT4KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJl ZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGlu Zm8vZHJpLWRldmVsCg==