Xi Wang e469853fcb drm/i915: fix integer overflow in i915_gem_do_execbuffer() ...

commit 44afb3a043 upstream.

On 32-bit systems, a large args->num_cliprects from userspace via ioctl
may overflow the allocation size, leading to out-of-bounds access.

This vulnerability was introduced in commit 432e58ed ("drm/i915: Avoid
allocation for execbuffer object list").

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2012-05-07 08:56:34 -07:00

..

drm

drm/i915: fix integer overflow in i915_gem_do_execbuffer()

2012-05-07 08:56:34 -07:00

stub

i915: select VIDEO_OUTPUT_CONTROL for ACPI_VIDEO

2011-04-13 09:10:25 +10:00

vga

Merge branch 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

2011-05-24 12:06:40 -07:00

Makefile

gpu: Add Intel GMA500(Poulsbo) Stub Driver

2010-10-26 11:00:13 +10:00