From: Kees Cook <[email protected]> It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows.
BUG=chromium-os:39733 TEST=link build, PoC fails [sending upstream] Change-Id: Ifdd4ae846042852a4462d70cfa3c3b84d5a9d133 Signed-off-by: Kees Cook <[email protected]> Reviewed-on: https://gerrit.chromium.org/gerrit/45118 Reviewed-by: Jorge Lucangeli Obes <[email protected]> Reviewed-by: Stéphane Marchesin <[email protected]> --- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c index 26d08bb..b23d6cd 100644 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c @@ -706,6 +706,7 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec, int count) { int i; + int total = 0; for (i = 0; i < count; i++) { char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr; @@ -715,6 +716,9 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec, if (exec[i].relocation_count > INT_MAX / sizeof(struct drm_i915_gem_relocation_entry)) return -EINVAL; + if (exec[i].relocation_count > INT_MAX - total) + return -EINVAL; + total += exec[i].relocation_count; length = exec[i].relocation_count * sizeof(struct drm_i915_gem_relocation_entry); -- 1.8.3.2 _______________________________________________ Intel-gfx mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/intel-gfx
