diff options
| author | Xi Wang <[email protected]> | 2011-11-23 06:12:01 +0000 |
|---|---|---|
| committer | Dave Airlie <[email protected]> | 2011-11-23 08:59:28 +0000 |
| commit | a5cd335165e31db9dbab636fd29895d41da55dd2 (patch) | |
| tree | 4d01d5801047b466c44c40231773e66a9dfb704d /fs/btrfs/async-thread.c | |
| parent | drivers/gpu/vga/vgaarb.c: add missing kfree (diff) | |
| download | kernel-a5cd335165e31db9dbab636fd29895d41da55dd2.tar.gz kernel-a5cd335165e31db9dbab636fd29895d41da55dd2.zip | |
drm: integer overflow in drm_mode_dirtyfb_ioctl()
There is a potential integer overflow in drm_mode_dirtyfb_ioctl()
if userspace passes in a large num_clips. The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result
in a memory corruption.
Reported-by: Haogang Chen <[email protected]>
Signed-off-by: Xi Wang <[email protected]>
Cc: [email protected]
Signed-off-by: Dave Airlie <[email protected]>
Diffstat (limited to 'fs/btrfs/async-thread.c')
0 files changed, 0 insertions, 0 deletions