diff options
| author | Kees Cook <keescook@chromium.org> | 2013-03-11 17:31:45 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-03-28 12:12:10 -0700 |
| commit | e03f8b87d6b11e8c2f9d31b221d8c536091485af (patch) | |
| tree | 999c254b541d2ed7249c09b8434dfb89ea86116c /lib/debugobjects.c | |
| parent | 5cec2bb0c7b4d16bb176b6299d4b6dd098c9db24 (diff) | |
drm/i915: bounds check execbuffer relocation count
commit 3118a4f652c7b12c752f3222af0447008f9b2368 upstream.
It is possible to wrap the counter used to allocate the buffer for
relocation copies. This could lead to heap writing overflows.
CVE-2013-0913
v3: collapse test, improve comment
v2: move check into validate_exec_list
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Pinkie Pie
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'lib/debugobjects.c')
0 files changed, 0 insertions, 0 deletions