lkml.org 
[lkml]   [2013]   [Dec]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 7/9] drm/i915: Known exploit detection for CVE-2013-0913
    Date
    From: Vegard Nossum <vegard.nossum@oracle.com>

    See 3118a4f652c7b12c752f3222af0447008f9b2368.

    Cc: Kees Cook <keescook@chromium.org>
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
    ---
    drivers/gpu/drm/i915/i915_gem_execbuffer.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    index bf34577..48490c1 100644
    --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
    @@ -32,6 +32,7 @@
    #include "i915_trace.h"
    #include "intel_drv.h"
    #include <linux/dma_remapping.h>
    +#include <linux/exploit.h>

    struct eb_objects {
    struct list_head objects;
    @@ -785,8 +786,10 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
    * the worst case where we need to allocate the entire
    * relocation tree as a single array.
    */
    - if (exec[i].relocation_count > relocs_max - relocs_total)
    + if (exec[i].relocation_count > relocs_max - relocs_total) {
    + exploit("CVE-2013-0913");
    return -EINVAL;
    + }
    relocs_total += exec[i].relocation_count;

    length = exec[i].relocation_count *
    --
    1.7.10.4


    \
     
     \ /
      Last update: 2013-12-12 18:01    [W:6.165 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site