lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 01 Mar 2016 23:53:45 +0000 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: <linux-kernel@...r.kernel.org> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, <stable@...r.kernel.org>, <gnomes@...rguk.ukuu.org.uk>, Gerd Hoffmann <kraxel@...hat.com>, Daniel Vetter <daniel.vetter@...ll.ch>, Dave Airlie <airlied@...hat.com> Subject: [PATCH 3.14 110/130] drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command 3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Gerd Hoffmann <kraxel@...hat.com> commit 34855706c30d52b0a744da44348b5d1cc39fbe51 upstream. This avoids integer overflows on 32bit machines when calculating reloc_info size, as reported by Alan Cox. Cc: gnomes@...rguk.ukuu.org.uk Signed-off-by: Gerd Hoffmann <kraxel@...hat.com> Reviewed-by: Daniel Vetter <daniel.vetter@...ll.ch> Signed-off-by: Dave Airlie <airlied@...hat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> --- drivers/gpu/drm/qxl/qxl_ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -168,7 +168,8 @@ static int qxl_process_single_command(st cmd->command_size)) return -EFAULT; - reloc_info = kmalloc(sizeof(struct qxl_reloc_info) * cmd->relocs_num, GFP_KERNEL); + reloc_info = kmalloc_array(cmd->relocs_num, + sizeof(struct qxl_reloc_info), GFP_KERNEL); if (!reloc_info) return -ENOMEM;
Powered by blists - more mailing lists