Xi Wang fb247af4cc drm/i915: fix integer overflow in i915_gem_execbuffer2() ...

commit ed8cd3b2cd upstream.

On 32-bit systems, a large args->buffer_count from userspace via ioctl
may overflow the allocation size, leading to out-of-bounds access.

This vulnerability was introduced in commit 8408c282 ("drm/i915:
First try a normal large kmalloc for the temporary exec buffers").

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2012-05-07 08:56:33 -07:00

..

drm

drm/i915: fix integer overflow in i915_gem_execbuffer2()

2012-05-07 08:56:33 -07:00

stub

i915: select VIDEO_OUTPUT_CONTROL for ACPI_VIDEO

2011-04-13 09:10:25 +10:00

vga

Merge branch 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6

2011-05-24 12:06:40 -07:00

Makefile

gpu: Add Intel GMA500(Poulsbo) Stub Driver

2010-10-26 11:00:13 +10:00