Li Qiang e7e11f9956 drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() ... In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the 'req->mip_levels' array. This array can be assigned any value from the user space. As both the 'num_sizes' and the array is uint32_t, it is easy to make 'num_sizes' overflow. The later 'mip_levels' is used as the loop count. This can lead an oob write. Add the check of 'req->mip_levels' to avoid this. Cc: <stable@vger.kernel.org> Signed-off-by: Li Qiang <liqiang6-s@360.cn> Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>		2017-03-30 11:46:26 +02:00
..
drm	drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()	2017-03-30 11:46:26 +02:00
host1x	gpu: host1x: Set OF node for new host1x devices	2017-01-30 11:47:44 +01:00
ipu-v3	gpu: ipu-v3: Stop overwriting pdev->dev.of_node of child devices	2017-02-17 08:04:27 +01:00
vga	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
Makefile