diff options
| author | Kees Cook <[email protected]> | 2013-03-11 17:31:45 -0700 |
|---|---|---|
| committer | Daniel Vetter <[email protected]> | 2013-03-13 21:31:03 +0100 |
| commit | 3118a4f652c7b12c752f3222af0447008f9b2368 (patch) | |
| tree | 22bc815888c57441e75528c14bd1d57aa4abdc37 /drivers/scsi/mpt2sas/mpi/mpi2_raid.h | |
| parent | 2563a4524febe8f4a98e717e02436d1aaf672aa2 (diff) | |
drm/i915: bounds check execbuffer relocation count
It is possible to wrap the counter used to allocate the buffer for
relocation copies. This could lead to heap writing overflows.
CVE-2013-0913
v3: collapse test, improve comment
v2: move check into validate_exec_list
Signed-off-by: Kees Cook <[email protected]>
Reported-by: Pinkie Pie
Cc: [email protected]
Reviewed-by: Chris Wilson <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
Diffstat (limited to 'drivers/scsi/mpt2sas/mpi/mpi2_raid.h')
0 files changed, 0 insertions, 0 deletions