Vladis Dronov ee9c4e681e drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() ... The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is a user-controlled 'uint32_t' value which is used as a loop count limit. This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'. References: https://bugzilla.redhat.com/show_bug.cgi?id=1437431 Cc: <stable@vger.kernel.org> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Reviewed-by: Sinclair Yeh <syeh@vmware.com>		2017-06-07 12:07:35 +02:00
..
device_include	drm/vmwgfx: Clear an uninitialized struct member	2017-01-26 20:52:36 -08:00
Kconfig	drm: fix compilations issues introduced by "drm: allow to use mmuless SoC"	2017-01-09 11:30:30 +01:00
Makefile	drm/vmwgfx: Re-implement the stream resource as a simple resource.	2017-03-31 15:21:17 -07:00
vmwgfx_binding.c
vmwgfx_binding.h
vmwgfx_buffer.c	drm/ttm: add io_mem_pfn callback	2017-04-04 23:33:42 -04:00
vmwgfx_cmdbuf_res.c
vmwgfx_cmdbuf.c	drm: Improve drm_mm search (and fix topdown allocation) with rbtrees	2017-02-03 11:10:32 +01:00
vmwgfx_context.c
vmwgfx_cotable.c
vmwgfx_dmabuf.c	drm/vmwgfx: Check pin count before attempting to move a buffer	2016-07-01 10:47:50 -07:00
vmwgfx_drv.c	drm/vmwgfx: Convert macro to octal representation	2017-04-21 09:25:47 -07:00
vmwgfx_drv.h	drm/vmwgfx: Add universal plane support	2017-03-31 09:13:08 -07:00
vmwgfx_execbuf.c	drm/vmwgfx: Avoid validating views on view destruction	2016-10-10 11:15:05 -07:00
vmwgfx_fb.c	drm/vmwgfx: Fix fbdev emulation using legacy functions	2017-04-07 13:28:32 -04:00
vmwgfx_fence.c	drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces	2017-03-30 11:43:39 +02:00
vmwgfx_fence.h	dma-buf: Rename struct fence to dma_fence	2016-10-25 14:40:39 +02:00
vmwgfx_fifo.c
vmwgfx_gmr.c
vmwgfx_gmrid_manager.c	gpu: drm: drivers: Convert printk(KERN_<LEVEL> to pr_<level>	2017-03-01 09:44:11 +01:00
vmwgfx_ioctl.c	drm/vmwgfx: Remove getparam error message	2017-03-30 11:43:40 +02:00
vmwgfx_irq.c
vmwgfx_kms.c	drm: Add acquire ctx to ->gamma_set hook	2017-04-06 10:21:55 +02:00
vmwgfx_kms.h	drm: Add acquire ctx to ->gamma_set hook	2017-04-06 10:21:55 +02:00
vmwgfx_ldu.c	drm/vmwgfx: Fix LDU X blank screen until mode change issue	2017-03-31 15:21:15 -07:00
vmwgfx_marker.c
vmwgfx_mob.c	drm/vmwgfx: Use kmemdup instead of kmalloc and memcpy	2017-01-26 21:26:17 -08:00
vmwgfx_msg.c	drm/vmwgfx: Add a check to handle host message failure	2016-07-01 10:47:47 -07:00
vmwgfx_msg.h	drm/vmwgfx: Add VMWare host messaging capability	2016-05-20 17:12:33 +02:00
vmwgfx_overlay.c
vmwgfx_prime.c	dma-buf: Rename dma-ops to prevent conflict with kunmap_atomic macro	2017-04-20 13:47:46 +05:30
vmwgfx_reg.h
vmwgfx_resource_priv.h	drm/vmwgfx: Introduce a simple resource type	2017-03-31 15:21:17 -07:00
vmwgfx_resource.c	Linux 4.11-rc6	2017-04-11 07:40:42 +10:00
vmwgfx_scrn.c	Merge tag 'drm-misc-next-2017-03-31' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-03 16:30:24 +10:00
vmwgfx_shader.c
vmwgfx_simple_resource.c	drm/vmwgfx: Introduce a simple resource type	2017-03-31 15:21:17 -07:00
vmwgfx_so.c
vmwgfx_so.h
vmwgfx_stdu.c	Merge tag 'drm-misc-next-2017-03-31' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-04-03 16:30:24 +10:00
vmwgfx_surface.c	drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()	2017-06-07 12:07:35 +02:00
vmwgfx_ttm_glue.c
vmwgfx_va.c	drm/vmwgfx: Re-implement the stream resource as a simple resource.	2017-03-31 15:21:17 -07:00