Re: [Intel-gfx] [PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-15 Thread Damien Lespiau
On Thu, Mar 14, 2013 at 12:32:00PM -0700, Kees Cook wrote: > On Thu, Mar 14, 2013 at 9:57 AM, Daniel Vetter wrote: > > On Wed, Mar 13, 2013 at 9:28 PM, Daniel Vetter wrote: > >> On Tue, Mar 12, 2013 at 09:07:46AM +, Chris Wilson wrote: > >>> On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees

Re: [Intel-gfx] [PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-15 Thread Damien Lespiau
On Thu, Mar 14, 2013 at 12:32:00PM -0700, Kees Cook wrote: On Thu, Mar 14, 2013 at 9:57 AM, Daniel Vetter daniel.vet...@ffwll.ch wrote: On Wed, Mar 13, 2013 at 9:28 PM, Daniel Vetter dan...@ffwll.ch wrote: On Tue, Mar 12, 2013 at 09:07:46AM +, Chris Wilson wrote: On Mon, Mar 11, 2013 at

Re: [PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-14 Thread Kees Cook
On Thu, Mar 14, 2013 at 9:57 AM, Daniel Vetter wrote: > On Wed, Mar 13, 2013 at 9:28 PM, Daniel Vetter wrote: >> On Tue, Mar 12, 2013 at 09:07:46AM +, Chris Wilson wrote: >>> On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees Cook wrote: >>> > It is possible to wrap the counter used to allocate

Re: [PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-14 Thread Daniel Vetter
On Wed, Mar 13, 2013 at 9:28 PM, Daniel Vetter wrote: > On Tue, Mar 12, 2013 at 09:07:46AM +, Chris Wilson wrote: >> On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees Cook wrote: >> > It is possible to wrap the counter used to allocate the buffer for >> > relocation copies. This could lead to

Re: [PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-14 Thread Daniel Vetter
On Wed, Mar 13, 2013 at 9:28 PM, Daniel Vetter dan...@ffwll.ch wrote: On Tue, Mar 12, 2013 at 09:07:46AM +, Chris Wilson wrote: On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees Cook wrote: It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead

Re: [PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-14 Thread Kees Cook
On Thu, Mar 14, 2013 at 9:57 AM, Daniel Vetter daniel.vet...@ffwll.ch wrote: On Wed, Mar 13, 2013 at 9:28 PM, Daniel Vetter dan...@ffwll.ch wrote: On Tue, Mar 12, 2013 at 09:07:46AM +, Chris Wilson wrote: On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees Cook wrote: It is possible to wrap

Re: [PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-13 Thread Daniel Vetter
On Tue, Mar 12, 2013 at 09:07:46AM +, Chris Wilson wrote: > On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees Cook wrote: > > It is possible to wrap the counter used to allocate the buffer for > > relocation copies. This could lead to heap writing overflows. > > > > CVE-2013-0913 > > > > v3:

Re: [PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-13 Thread Daniel Vetter
On Tue, Mar 12, 2013 at 09:07:46AM +, Chris Wilson wrote: On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees Cook wrote: It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows. CVE-2013-0913 v3: collapse test,

Re: [PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-12 Thread Chris Wilson
On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees Cook wrote: > It is possible to wrap the counter used to allocate the buffer for > relocation copies. This could lead to heap writing overflows. > > CVE-2013-0913 > > v3: collapse test, improve comment > v2: move check into validate_exec_list > >

Re: [PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-12 Thread Chris Wilson
On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees Cook wrote: It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows. CVE-2013-0913 v3: collapse test, improve comment v2: move check into validate_exec_list

[PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-11 Thread Kees Cook
It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows. CVE-2013-0913 v3: collapse test, improve comment v2: move check into validate_exec_list Signed-off-by: Kees Cook Reported-by: Pinkie Pie Cc: sta...@vger.kernel.org

[PATCH v3] drm/i915: bounds check execbuffer relocation count

2013-03-11 Thread Kees Cook
It is possible to wrap the counter used to allocate the buffer for relocation copies. This could lead to heap writing overflows. CVE-2013-0913 v3: collapse test, improve comment v2: move check into validate_exec_list Signed-off-by: Kees Cook keesc...@chromium.org Reported-by: Pinkie Pie Cc: