mirror of
https://git.yoctoproject.org/meta-ti
synced 2026-07-17 06:48:07 +00:00
Koen Kooi
2177f80076
Duplicate patches between PSP and 3.2.17 have been dropped from the 3.2.17 series Signed-off-by: Koen Kooi <koen@dominion.thruhere.net> Signed-off-by: Denys Dmytriyenko <denys@ti.com>
42 lines
1.4 KiB
Diff
42 lines
1.4 KiB
Diff
From f69e43d73be5dc1a1b1550c12c06f32d7eeee9b5 Mon Sep 17 00:00:00 2001
|
|
From: Xi Wang <xi.wang@gmail.com>
|
|
Date: Mon, 23 Apr 2012 04:06:42 -0400
|
|
Subject: [PATCH 109/165] drm/i915: fix integer overflow in
|
|
i915_gem_do_execbuffer()
|
|
|
|
commit 44afb3a04391a74309d16180d1e4f8386fdfa745 upstream.
|
|
|
|
On 32-bit systems, a large args->num_cliprects from userspace via ioctl
|
|
may overflow the allocation size, leading to out-of-bounds access.
|
|
|
|
This vulnerability was introduced in commit 432e58ed ("drm/i915: Avoid
|
|
allocation for execbuffer object list").
|
|
|
|
Signed-off-by: Xi Wang <xi.wang@gmail.com>
|
|
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
|
|
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
|
|
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
|
|
---
|
|
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 5 +++++
|
|
1 files changed, 5 insertions(+), 0 deletions(-)
|
|
|
|
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
|
index 5b6fe31..a6c2f7a 100644
|
|
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
|
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
|
|
@@ -1057,6 +1057,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
|
|
return -EINVAL;
|
|
}
|
|
|
|
+ if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) {
|
|
+ DRM_DEBUG("execbuf with %u cliprects\n",
|
|
+ args->num_cliprects);
|
|
+ return -EINVAL;
|
|
+ }
|
|
cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects),
|
|
GFP_KERNEL);
|
|
if (cliprects == NULL) {
|
|
--
|
|
1.7.7.6
|
|
|