| commit | 3118a4f652c7b12c752f3222af0447008f9b2368 | [log] [tgz] |
|---|---|---|
| author | Kees Cook <keescook@chromium.org> | Mon Mar 11 17:31:45 2013 -0700 |
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | Wed Mar 13 21:31:03 2013 +0100 |
| tree | 22bc815888c57441e75528c14bd1d57aa4abdc37 | |
| parent | 2563a4524febe8f4a98e717e02436d1aaf672aa2 [diff] |
drm/i915: bounds check execbuffer relocation count It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows. CVE-2013-0913 v3: collapse test, improve comment v2: move check into validate_exec_list Signed-off-by: Kees Cook <keescook@chromium.org> Reported-by: Pinkie Pie Cc: stable@vger.kernel.org Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>