Commit d1d78830 authored by Chris Wilson's avatar Chris Wilson

drm/i915: Prevent integer overflow when validating the execbuffer

Commit 2549d6c2 removed the vmalloc used for temporary storage of the
relocation lists used during execbuffer. However, our use of vmalloc was
being protected by an integer overflow check which we do want to
preserve!
Reported-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
parent 16c59ef3
...@@ -3630,8 +3630,15 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec, ...@@ -3630,8 +3630,15 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr; char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
size_t length = exec[i].relocation_count * sizeof(struct drm_i915_gem_relocation_entry); int length; /* limited by fault_in_pages_readable() */
/* First check for malicious input causing overflow */
if (exec[i].relocation_count >
INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
return -EINVAL;
length = exec[i].relocation_count *
sizeof(struct drm_i915_gem_relocation_entry);
if (!access_ok(VERIFY_READ, ptr, length)) if (!access_ok(VERIFY_READ, ptr, length))
return -EFAULT; return -EFAULT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment