diff options
| author | Arnd Bergmann <arnd@arndb.de> | 2013-04-09 15:29:20 +0200 |
|---|---|---|
| committer | Arnd Bergmann <arnd@arndb.de> | 2013-04-09 15:29:43 +0200 |
| commit | 44c0d2377539fafd1023ec7e16765b71c7f4fbce (patch) | |
| tree | 49065c2af83c723f150bf636939790ad3108a897 /drivers/gpu/drm/i915/i915_gem_execbuffer.c | |
| parent | 8024206dbf4e0701f0cdf259a122ea23db3a7a16 (diff) | |
| parent | 07961ac7c0ee8b546658717034fe692fd12eefa9 (diff) | |
| download | olio-linux-3.10-44c0d2377539fafd1023ec7e16765b71c7f4fbce.tar.xz olio-linux-3.10-44c0d2377539fafd1023ec7e16765b71c7f4fbce.zip | |
Merge tag 'v3.9-rc5' into next/cleanup
This is a dependency for the mxs/cleanup branch.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Diffstat (limited to 'drivers/gpu/drm/i915/i915_gem_execbuffer.c')
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem_execbuffer.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c index 2f2daebd0ee..3b11ab0fbc9 100644 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c @@ -732,6 +732,8 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec, int count) { int i; + int relocs_total = 0; + int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry); for (i = 0; i < count; i++) { char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr; @@ -740,10 +742,13 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec, if (exec[i].flags & __EXEC_OBJECT_UNKNOWN_FLAGS) return -EINVAL; - /* First check for malicious input causing overflow */ - if (exec[i].relocation_count > - INT_MAX / sizeof(struct drm_i915_gem_relocation_entry)) + /* First check for malicious input causing overflow in + * the worst case where we need to allocate the entire + * relocation tree as a single array. + */ + if (exec[i].relocation_count > relocs_max - relocs_total) return -EINVAL; + relocs_total += exec[i].relocation_count; length = exec[i].relocation_count * sizeof(struct drm_i915_gem_relocation_entry); |