ACK: [CVE-2017-7346][PATCH X/Y/Z/A] drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl()

Seth Forshee seth.forshee at
Wed Jun 14 15:46:01 UTC 2017

On Wed, Jun 14, 2017 at 05:09:35PM +0800, Po-Hsu Lin wrote:
> From: Vladis Dronov <vdronov at>
> CVE-2017-7346
> The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is
> a user-controlled 'uint32_t' value which is used as a loop count limit.
> This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'.
> References:
> Cc: <stable at>
> Signed-off-by: Vladis Dronov <vdronov at>
> Reviewed-by: Sinclair Yeh <syeh at>
> (cherry picked from commit ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf)
> Signed-off-by: Po-Hsu Lin <po-hsu.lin at>

Acked-by: Seth Forshee <seth.forshee at>

More information about the kernel-team mailing list