Xi Wang
44afb3a043
drm/i915: fix integer overflow in i915_gem_do_execbuffer() ...
On 32-bit systems, a large args->num_cliprects from userspace via ioctl
may overflow the allocation size, leading to out-of-bounds access.
This vulnerability was introduced in commit 432e58ed ("drm/i915: Avoid
allocation for execbuffer object list").
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2012-04-23 22:32:15 +02:00
2012-04-20 11:19:35 -07:00
2012-04-13 14:04:08 +01:00
2012-04-18 14:33:25 -04:00
2012-04-09 14:54:22 -07:00
2012-04-10 14:13:30 -04:00
2012-04-20 11:31:00 -07:00
2012-04-09 15:47:49 -04:00
2012-04-12 15:36:33 -07:00
2012-04-12 00:05:05 +02:00
2012-04-13 17:57:40 -07:00
2012-04-06 21:48:59 -04:00
2012-04-09 15:13:40 +08:00
2012-04-17 16:29:41 +02:00
2012-04-06 17:56:20 -07:00
2012-04-10 22:15:39 -06:00
2012-04-23 22:32:15 +02:00
2012-04-20 10:39:33 -07:00
2012-04-18 11:15:50 -07:00
2012-04-10 08:09:03 -07:00
2012-04-05 15:25:50 -07:00
2012-04-12 18:51:32 -07:00
2012-04-16 16:45:34 +02:00
2012-04-05 15:30:34 -07:00
2012-04-12 15:36:33 -07:00
2012-04-17 16:29:31 +02:00
2012-04-12 16:05:06 +10:00
2012-04-21 12:43:23 -07:00
2012-04-16 21:27:07 +02:00
2012-04-05 15:30:34 -07:00
2012-04-20 21:52:13 -04:00
2012-04-09 01:38:55 -04:00
2012-04-12 14:04:33 -07:00
2012-04-10 14:20:56 -06:00
2012-04-05 15:25:50 -07:00
2012-04-16 18:33:35 -07:00
2012-03-29 16:00:48 -07:00
2012-04-11 09:31:02 +02:00
2012-03-30 16:45:39 -07:00
2012-03-30 16:45:39 -07:00
2012-03-30 16:09:02 -07:00
2012-04-10 10:26:41 -07:00
2012-04-05 15:25:50 -07:00
2012-04-12 13:12:12 -07:00
2012-04-11 14:28:24 +02:00
2012-04-15 11:08:53 -07:00
2012-03-30 00:09:17 -07:00
2012-04-15 17:35:19 -07:00
2012-04-12 15:35:12 -07:00
2012-04-06 18:57:05 -07:00
2012-04-19 19:15:35 -07:00
2012-04-21 12:45:52 -07:00
2012-04-18 13:15:51 -07:00
2012-04-12 10:35:42 +03:00
2012-04-15 11:14:54 -07:00
2012-04-15 11:51:06 +03:00
2012-03-29 18:02:10 -07:00
2012-04-19 15:12:49 -04:00
2012-04-02 09:50:40 -07:00
2012-04-02 09:50:40 -07:00
44afb3a043