Dan Carpenter 08a7525811
drm/vmwgfx: Potential off by one in vmw_view_add() ...
commit 0d9cac0ca0429830c40fe1a4e50e60f6221fd7b6 upstream.
The vmw_view_cmd_to_type() function returns vmw_view_max (3) on error.
It's one element beyond the end of the vmw_view_cotables[] table.
My read on this is that it's possible to hit this failure. header->id
comes from vmw_cmd_check() and it's a user controlled number between
1040 and 1225 so we can hit that error. But I don't have the hardware
to test this code.
Fixes: d80efd5cb3dan.carpenter@oracle.com >
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2018-01-17 09:38:54 +01:00
2017-12-29 17:42:58 +01:00
2017-08-30 10:21:53 +02:00
2017-12-14 09:28:19 +01:00
2017-12-14 09:28:24 +01:00
2017-03-30 09:41:27 +02:00
2017-12-25 14:23:44 +01:00
2018-01-17 09:38:54 +01:00
2017-12-25 14:23:46 +01:00
2018-01-10 09:29:52 +01:00
2017-12-16 16:25:46 +01:00
2017-12-29 17:43:00 +01:00
2017-10-27 10:38:08 +02:00
2017-12-25 14:23:42 +01:00
2017-12-25 14:23:46 +01:00
2018-01-10 09:29:51 +01:00
2017-08-06 18:59:43 -07:00
2017-09-27 14:39:24 +02:00
2017-12-20 10:07:27 +01:00
2017-12-09 22:01:56 +01:00
2017-12-14 09:28:22 +01:00
2017-11-21 09:23:21 +01:00
2017-12-20 10:07:26 +01:00
2017-12-14 09:28:18 +01:00
2018-01-17 09:38:54 +01:00
2017-12-25 14:23:40 +01:00
2017-12-20 10:07:23 +01:00
2017-12-25 14:23:40 +01:00
2017-12-20 10:07:22 +01:00
2017-12-14 09:28:21 +01:00
2017-04-12 12:41:17 +02:00
2017-12-09 22:01:49 +01:00
2018-01-17 09:38:50 +01:00
2018-01-10 09:29:53 +01:00
2018-01-10 09:29:53 +01:00
2017-12-20 10:07:21 +01:00
2017-12-25 14:23:42 +01:00
2017-08-30 10:21:51 +02:00
2017-08-06 18:59:42 -07:00
2017-09-09 17:39:41 +02:00
2018-01-17 09:38:49 +01:00
2017-12-14 09:28:17 +01:00
2017-12-14 09:28:16 +01:00
2017-12-29 17:42:58 +01:00
2017-12-25 14:23:36 +01:00
2017-12-20 10:07:23 +01:00
2018-01-10 09:29:54 +01:00
2018-01-17 09:38:53 +01:00
2017-08-06 18:59:42 -07:00
2017-08-30 10:21:55 +02:00
2017-12-29 17:43:00 +01:00
2017-12-25 14:23:37 +01:00
2017-08-06 18:59:48 -07:00
2017-07-27 15:08:08 -07:00
2017-12-29 17:42:59 +01:00
2017-06-17 06:41:54 +02:00
2017-12-29 17:42:59 +01:00
2017-05-14 14:00:19 +02:00
2017-12-29 17:42:59 +01:00
2018-01-17 09:38:51 +01:00
2017-11-21 09:23:25 +01:00
2017-04-21 09:31:22 +02:00
2017-12-14 09:28:22 +01:00
2017-11-02 09:49:15 +01:00
2017-10-08 10:26:03 +02:00
2017-12-25 14:23:46 +01:00
2018-01-02 20:35:15 +01:00
2017-12-25 14:23:45 +01:00
2017-12-20 10:07:32 +01:00
2017-12-29 17:42:59 +01:00
2017-07-27 15:08:08 -07:00
2017-12-25 14:23:45 +01:00
2017-12-20 10:07:29 +01:00
2017-12-25 14:23:46 +01:00
2018-01-02 20:35:17 +01:00
2018-01-17 09:38:52 +01:00
2017-10-12 11:51:19 +02:00
2017-12-25 14:23:45 +01:00
2017-12-25 14:23:37 +01:00
2017-12-25 14:23:43 +01:00
2017-12-25 14:23:42 +01:00
2017-10-21 17:21:33 +02:00
2017-11-30 08:39:15 +00:00
2017-05-20 14:28:35 +02:00
Dan Carpenter
08a7525811