From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6789648551B for ; Tue, 18 Aug 2026 18:24:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787077466; cv=none; b=bRRcBZaHHtEJyC5+ZJybx8CGOzpxz5FKV2ppcRv20MkxcLBICNUUiHNdPHlkib6c1hax2UtYxv45DXmmRlzZURZa6wXkPCfC4csW+SM6fr+oAd2YFCdctTMMziNapKG5a1UnywQ21zFQVLmwByYNcCuFnwt230z4JsGSv43WRWI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787077466; c=relaxed/simple; bh=wqPPOm/yXaMipv+y5NQC+ABxnF2CxAaaY6MQWXdEXMg=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=bRK7EXQbyP7uPzTQ0iCQ1wk5MT5nrwDFCaxlV8WqGtrvibWZryElU3w+H2f6oCgZ3GW8CRWm9+wFPDqB6mPnKY/isuP6SrPifY1lPdqUyPISNnzpFmDpLzlFXm7iGbdm/C0Ez9bHrPnQDeCfq/FPEHjCgxG8c9rU71oDHd/zg+Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=gYs+GSMn; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=mlEbSs7M; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="gYs+GSMn"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="mlEbSs7M" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1787077464; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5EjK1grTNkC5kVSY96HRtQJcSC7mxO3Y6rELa2KIFGI=; b=gYs+GSMnyaAzGHc/FTyuFePqH2AMYw90dPyQgbNgBFdD/eMtqjWh95xyWQ4isdk8uzYTGd 37OXTjm52/YCk/Slg5LonpITEKAQM/0qXKKAlyKOocZFJS3jiEoCLISCqAbTe2Pct6kBQp DK+Qq7nYLCzd+wF+wJDacRGQC++liPg= Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-640-UwgKcIFEP9eqB2ezONsifg-1; Tue, 18 Aug 2026 14:24:23 -0400 X-MC-Unique: UwgKcIFEP9eqB2ezONsifg-1 X-Mimecast-MFC-AGG-ID: UwgKcIFEP9eqB2ezONsifg_1787077463 Received: by mail-qv1-f70.google.com with SMTP id 6a1803df08f44-90a602a4e6fso4901496d6.1 for ; Tue, 18 Aug 2026 11:24:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1787077463; x=1787682263; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:content-type :references:in-reply-to:date:cc:to:from:subject:message-id:from:to :cc:subject:date:message-id:reply-to:content-type; bh=5EjK1grTNkC5kVSY96HRtQJcSC7mxO3Y6rELa2KIFGI=; b=mlEbSs7MwbXmgbW31Bf8ZYFODY1BtEs/cGlLUl3MuAnip18cY+47gwZ9jMsdCRTmJd LIN8qZRdHNXhqzx+TJ15gpwUa3DOiF8wqx+Cs7xH8KBMPpw2VWbkqbRGdnZpwwpukTBG xgYSROsbtRql7ahpVfY+N7R9FpGLpwOJBS3VQZ9JKe8thtHkok72P5LSoh2y0xZwNXJq b9QICHGqTWv3RbYBL6s1CbBeIxGAE0OeReygEW1D5gaa+1tQDh9IwSTxwgaxBPqZFnoD bjueL7i+NRdjPWiFBGcvDInlGakp7nxFrR3V6h5SM9bJBKje5lsO8Y6R8w61BuX8dGcf AyiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787077463; x=1787682263; h=mime-version:user-agent:content-transfer-encoding:content-type :references:in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=5EjK1grTNkC5kVSY96HRtQJcSC7mxO3Y6rELa2KIFGI=; b=rBEm66sq5ng1+EDWsw/clPDMyT3x0zKttsUFBtyujWJuN4DNZtsp9ruts0u5kC4U14 ZQP6uXuwlqAHQJKUv9bFOIiec5ruvvpzit1CwAMv654p3rlFPzBvRag7aMWUbzhW6RqZ mRuoQAUZHWR11LaaoNyYARvOaaVw6jgLDCE7ztF2ZY1XdvHScnCHhhSyJlY5dAiAwgzf ca6riiSC7iQS6YGQXw/mmNojIHBQYsM52h9ql5CWW6Bqt+Li150eeeypwu2fd9Mifv9V cMfiHVc1tjhi8MIi34bPAsB9gmQ1TUo903bvZngEPltaNKLaZs80Swp/6jss4oLBBEAg gCxg== X-Forwarded-Encrypted: i=1; AHgh+RoAVQHRZYGHlUu8/yEZTdSqN5AhWk+8LKo2bwKoTK4C39FiMoAgl5CRnvTJtJM9hrZ1X4ajPiT8LfVfLTY=@vger.kernel.org X-Gm-Message-State: AOJu0Yxb4SyHG/2RU/+bxg6gO6IyxVd0UWiX0mAl1yntJ0nh7b+uOLc4 NVGUQf5UzuJd/EOQT8tdtzGqO9pQ5DioK4jlFAkmbOfjfPxhjfnpEMHEYofXBZr/d+mpivRsmuI joJu8sIlG8zAh4m4ZGhGbiSMd5XHfU0oOuDHy6dzIAmJ9Lc8GwuVX7NcgP8lvgyQZRw== X-Gm-Gg: AR+sD103Ci1FuAJvd7A2213AalLW5ybS1YwcgAUmY1OooEAyzNs/ROE8TYvR9qF5TQH UHNqBa8Ws7pk+3JQwAc1Vgskv2MVV8grz9YTlBElWZiFwzVhE/5t6K4HR3qlmrKIh9r06cHLeUW 5ZDRbwIfIRaqoYyoHmOpXka6QGrPv6DR+Osz1tuUBGy8GEF/3qbzskm/wXp0+nkeFl4/+SAmEa7 gSHLKpmeaoV5shf5IctWCHd3pEOgEWdvXPwh7DOJx+GIehOQYLapeZTuoT6Yf5HLqdliUlWcW17 6QQ2O1SY2oZVd0fQTTMNgvd5vzjOaGLyqJliIDNsLtA0axy+vSQVzK/0qIOQdbDWZYCvSTad X-Received: by 2002:ad4:5aea:0:b0:8f7:43f4:fe8d with SMTP id 6a1803df08f44-90c5c423802mr2386906d6.29.1787077462465; Tue, 18 Aug 2026 11:24:22 -0700 (PDT) X-Received: by 2002:ad4:5aea:0:b0:8f7:43f4:fe8d with SMTP id 6a1803df08f44-90c5c423802mr2386196d6.29.1787077461736; Tue, 18 Aug 2026 11:24:21 -0700 (PDT) Received: from [192.168.8.4] ([100.0.180.93]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-90c4597695csm37005146d6.40.2026.08.18.11.24.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 18 Aug 2026 11:24:20 -0700 (PDT) Message-ID: <25ccdb08f6d84982fb211444dd766d054258e41c.camel@redhat.com> Subject: Re: [PATCH] drm/nouveau/nv04: check cursor buffer object size before upload From: lyude@redhat.com To: Zhenhao Wan , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Airlie , Ben Skeggs Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yuhao Jiang , stable@vger.kernel.org Date: Tue, 18 Aug 2026 14:24:19 -0400 In-Reply-To: <20260813-nouveau-nv04-cursor-oob-v1-1-3f3eb37d213d@gmail.com> References: <20260813-nouveau-nv04-cursor-oob-v1-1-3f3eb37d213d@gmail.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.3 (3.58.3-1.fc43) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Thu, 2026-08-13 at 18:35 +0800, Zhenhao Wan wrote: > struct drm_file *file_priv, > =C2=A0 return -ENOENT; > =C2=A0 cursor =3D nouveau_gem_object(gem); > =C2=A0 > + if (gem->size < width * height * 4) { > + ret =3D -EINVAL; > + goto out; > + } > + A good start - but width and/or height could be UINT32_MAX, so a caller could still overflow width or height. Would you mind adding an overflow multiply check? > =C2=A0 ret =3D nouveau_bo_map(cursor); > =C2=A0 if (ret) > =C2=A0 goto out; >=20 > --- > base-commit: db2ddb87143519e20a95aa36c60b36107b736a58 > change-id: 20260813-nouveau-nv04-cursor-oob-ad2b6001de3d >=20 > Best regards, > --=C2=A0=20 > Zhenhao Wan