diff options
| author | Ingo Molnar <mingo@kernel.org> | 2013-04-08 17:41:50 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2013-04-08 17:41:50 +0200 |
| commit | b6d5278dc8385eaf2e3904a4af444a04f6ae4e71 (patch) | |
| tree | 14e6031e0efa8e8b684db3b7ff85f8ac63ed0824 /drivers/gpu/drm/i915/i915_gem_execbuffer.c | |
| parent | bafcdd3b6cb86035cdb0511450961edcdc084c27 (diff) | |
| parent | 7a0c819d28f5c91955854e048766d6afef7c8a3d (diff) | |
| download | olio-linux-3.10-b6d5278dc8385eaf2e3904a4af444a04f6ae4e71.tar.xz olio-linux-3.10-b6d5278dc8385eaf2e3904a4af444a04f6ae4e71.zip | |
Merge tag 'please-pull-cmci_rediscover' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras into x86/ras
Pull clean up of the cmci_rediscover code to fix problems found by Dave Jones,
from Tony Luck.
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/gpu/drm/i915/i915_gem_execbuffer.c')
| -rw-r--r-- | drivers/gpu/drm/i915/i915_gem_execbuffer.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c index 2f2daebd0ee..3b11ab0fbc9 100644 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c @@ -732,6 +732,8 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec, int count) { int i; + int relocs_total = 0; + int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry); for (i = 0; i < count; i++) { char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr; @@ -740,10 +742,13 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec, if (exec[i].flags & __EXEC_OBJECT_UNKNOWN_FLAGS) return -EINVAL; - /* First check for malicious input causing overflow */ - if (exec[i].relocation_count > - INT_MAX / sizeof(struct drm_i915_gem_relocation_entry)) + /* First check for malicious input causing overflow in + * the worst case where we need to allocate the entire + * relocation tree as a single array. + */ + if (exec[i].relocation_count > relocs_max - relocs_total) return -EINVAL; + relocs_total += exec[i].relocation_count; length = exec[i].relocation_count * sizeof(struct drm_i915_gem_relocation_entry); |