Am 23.12.2014 um 10:56 schrieb Dan Carpenter:

The test:

if (size > RADEON_MAX_TEXTURE_SIZE) {

"size" is an integer and it's controled by the user so it can be negative and the test can underflow. Later we use "size" in:

dwords = size / 4; ... RADEON_COPY_MT(buffer, data, (int)(dwords * sizeof(u32)));

It causes memory corruption to copy a negative size buffer.

Signed-off-by: Dan Carpenter dan.carpenter@oracle.com

This specific line of code is completely deprecated and the patch is just another coffin nail to finally remove it.

But since we can't be sure that it doesn't break any userspace still in use I'm generally ok to apply the patch and it is Reviewed-by: Christian König christian.koenig@amd.com

Regards, Christian.

---

Static checkers complain about the integer overflows here, and there are many real overflows but they appear harmless.

diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c index 535403e..15aee72 100644 --- a/drivers/gpu/drm/radeon/radeon_state.c +++ b/drivers/gpu/drm/radeon/radeon_state.c @@ -1703,7 +1703,7 @@ static int radeon_cp_dispatch_texture(struct drm_device * dev, u32 format; u32 *buffer; const u8 __user *data;

• int size, dwords, tex_width, blit_width, spitch;

• unsigned int size, dwords, tex_width, blit_width, spitch; u32 height; int i; u32 texpitch, microtile;