projects / GitHub / exynos8895 / android_kernel_samsung_universal8895.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 2563a45) | patch
drm/i915: bounds check execbuffer relocation count
authorKees Cook <keescook@chromium.org>
Tue, 12 Mar 2013 00:31:45 +0000 (17:31 -0700)
committerDaniel Vetter <daniel.vetter@ffwll.ch>
Wed, 13 Mar 2013 20:31:03 +0000 (21:31 +0100)
commit3118a4f652c7b12c752f3222af0447008f9b2368
tree22bc815888c57441e75528c14bd1d57aa4abdc37tree | snapshot (tar.gz zip)
parent2563a4524febe8f4a98e717e02436d1aaf672aa2commit | diff
drm/i915: bounds check execbuffer relocation count

It is possible to wrap the counter used to allocate the buffer for
relocation copies. This could lead to heap writing overflows.

CVE-2013-0913

v3: collapse test, improve comment
v2: move check into validate_exec_list

Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Pinkie Pie
Cc: stable@vger.kernel.org
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
drivers/gpu/drm/i915/i915_gem_execbuffer.c diff | blob | blame | history