https://github.com/torvalds/linux
Revision 2b6207291b7b277a5df9d1aab44b56815a292dba authored by Dan Carpenter on 16 May 2018, 14:00:26 UTC, committed by Daniel Vetter on 16 May 2018, 15:56:06 UTC
There is a comment here which says that DIV_ROUND_UP() and that's where the problem comes from. Say you pick: args->bpp = UINT_MAX - 7; args->width = 4; args->height = 1; The integer overflow in DIV_ROUND_UP() means "cpp" is UINT_MAX / 8 and because of how we picked args->width that means cpp < UINT_MAX / 4. I've fixed it by preventing the integer overflow in DIV_ROUND_UP(). I removed the check for !cpp because it's not possible after this change. I also changed all the 0xffffffffU references to U32_MAX. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20180516140026.GA19340@mwanda
1 parent 72cb0d8
Tip revision: 2b6207291b7b277a5df9d1aab44b56815a292dba authored by Dan Carpenter on 16 May 2018, 14:00:26 UTC
drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl()
drm/dumb-buffers: Integer overflow in drm_mode_create_ioctl()
Tip revision: 2b62072
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| LICENSES | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| firmware | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .clang-format | -rw-r--r-- | 12.8 KB |
| .cocciconfig | -rw-r--r-- | 59 bytes |
| .get_maintainer.ignore | -rw-r--r-- | 31 bytes |
| .gitattributes | -rw-r--r-- | 30 bytes |
| .gitignore | -rw-r--r-- | 1.5 KB |
| .mailmap | -rw-r--r-- | 9.2 KB |
| COPYING | -rw-r--r-- | 423 bytes |
| CREDITS | -rw-r--r-- | 96.3 KB |
| Kbuild | -rw-r--r-- | 2.2 KB |
| Kconfig | -rw-r--r-- | 287 bytes |
| MAINTAINERS | -rw-r--r-- | 441.9 KB |
| Makefile | -rw-r--r-- | 61.0 KB |
| README | -rw-r--r-- | 800 bytes |
Computing file changes ...
