Skip to content

Commit 6377406

Browse files
Murray McAllisterthomashvmw
authored andcommitted
drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()), which can leak useful addresses to dmesg. Add check to avoid a size of 0. Cc: <[email protected]> Signed-off-by: Murray McAllister <[email protected]> Reviewed-by: Sinclair Yeh <[email protected]>
1 parent 36274ab commit 6377406

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
186186
bool gb_objects = !!(dev_priv->capabilities & SVGA_CAP_GBOBJECTS);
187187
struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);
188188

189-
if (unlikely(arg->pad64 != 0)) {
189+
if (unlikely(arg->pad64 != 0 || arg->max_size == 0)) {
190190
DRM_ERROR("Illegal GET_3D_CAP argument.\n");
191191
return -EINVAL;
192192
}

0 commit comments

Comments
 (0)