tree b7de610a963347d9dfaa6bacf8cfb2ab3bf7220b
parent 98648ae6ef6bdcdcb88c46cad963906ab452e96d
author Dan Carpenter <dan.carpenter@oracle.com> 1515577204 +0300
committer Thomas Hellstrom <thellstrom@vmware.com> 1515594099 +0100

drm/vmwgfx: Potential off by one in vmw_view_add()

The vmw_view_cmd_to_type() function returns vmw_view_max (3) on error.
It's one element beyond the end of the vmw_view_cotables[] table.

My read on this is that it's possible to hit this failure.  header->id
comes from vmw_cmd_check() and it's a user controlled number between
1040 and 1225 so we can hit that error.  But I don't have the hardware
to test this code.

Fixes: d80efd5cb3de ("drm/vmwgfx: Initial DX support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Cc: <stable@vger.kernel.org>