From: Kees Cook <keescook@chromium.org>
Date: Tue, 12 Mar 2013 00:31:45 +0000 (-0700)
Subject: drm/i915: bounds check execbuffer relocation count
X-Git-Tag: v3.9-rc4~19^2^2~4
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3118a4f652c7b12c752f3222af0447008f9b2368;p=pandora-kernel.git

drm/i915: bounds check execbuffer relocation count

It is possible to wrap the counter used to allocate the buffer for
relocation copies. This could lead to heap writing overflows.

CVE-2013-0913

v3: collapse test, improve comment
v2: move check into validate_exec_list

Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Pinkie Pie
Cc: stable@vger.kernel.org
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
---

Reading git-diff-tree failed