drm/i915: bounds check execbuffer relocation count
authorKees Cook <keescook@chromium.org>
Tue, 12 Mar 2013 00:31:45 +0000 (17:31 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 28 Mar 2013 19:12:10 +0000 (12:12 -0700)
commite03f8b87d6b11e8c2f9d31b221d8c536091485af
tree999c254b541d2ed7249c09b8434dfb89ea86116c
parent5cec2bb0c7b4d16bb176b6299d4b6dd098c9db24
drm/i915: bounds check execbuffer relocation count

commit 3118a4f652c7b12c752f3222af0447008f9b2368 upstream.

It is possible to wrap the counter used to allocate the buffer for
relocation copies. This could lead to heap writing overflows.

CVE-2013-0913

v3: collapse test, improve comment
v2: move check into validate_exec_list

Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Pinkie Pie
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/gpu/drm/i915/i915_gem_execbuffer.c