On Sun, Nov 21, 2010 at 09:23:46AM +, Chris Wilson wrote:
> On Sat, 20 Nov 2010 21:32:07 +0300, Dan Carpenter
> wrote:
> > Hello Chris,
> >
> > Is there an integer overflow in validate_exec_list()?
> >
> > drivers/gpu/drm/i915/i915_gem.c
> > 3633 size_t length =
On Mon, 22 Nov 2010 12:56:42 +0300, Dan Carpenter wrote:
> On Sun, Nov 21, 2010 at 09:23:46AM +, Chris Wilson wrote:
> > Yes, it could. Not through normal use since relocation count can not be
> > more than buffer length, hence realistically capped at around 4k entries.
> > However...
> >
>
On Sun, Nov 21, 2010 at 09:23:46AM +, Chris Wilson wrote:
On Sat, 20 Nov 2010 21:32:07 +0300, Dan Carpenter erro...@gmail.com wrote:
Hello Chris,
Is there an integer overflow in validate_exec_list()?
drivers/gpu/drm/i915/i915_gem.c
3633 size_t length =
On Mon, 22 Nov 2010 12:56:42 +0300, Dan Carpenter erro...@gmail.com wrote:
On Sun, Nov 21, 2010 at 09:23:46AM +, Chris Wilson wrote:
Yes, it could. Not through normal use since relocation count can not be
more than buffer length, hence realistically capped at around 4k entries.
On Sat, 20 Nov 2010 21:32:07 +0300, Dan Carpenter wrote:
> Hello Chris,
>
> Is there an integer overflow in validate_exec_list()?
>
> drivers/gpu/drm/i915/i915_gem.c
> 3633 size_t length = exec[i].relocation_count * sizeof(struct
> drm_i915_gem_relocation_entry);
> 3634
> 3635
On Sat, 20 Nov 2010 21:32:07 +0300, Dan Carpenter erro...@gmail.com wrote:
Hello Chris,
Is there an integer overflow in validate_exec_list()?
drivers/gpu/drm/i915/i915_gem.c
3633 size_t length = exec[i].relocation_count * sizeof(struct
drm_i915_gem_relocation_entry);
3634
Hello Chris,
Is there an integer overflow in validate_exec_list()?
drivers/gpu/drm/i915/i915_gem.c
3633 size_t length = exec[i].relocation_count * sizeof(struct
drm_i915_gem_relocation_entry);
3634
3635 if (!access_ok(VERIFY_READ, ptr, length))
3636
