[PATCH 7/9] drm/i915: Known exploit detection for CVE-2013-0913

vegard.nossum
2013-12-12T16:54:52Z

From: Vegard Nossum <vegard.nossum@oracle.com>

See 3118a4f652c7b12c752f3222af0447008f9b2368.

Cc: Kees Cook <keescook@chromium.org>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
---
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index bf34577..48490c1 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -32,6 +32,7 @@
#include "i915_trace.h"
#include "intel_drv.h"
#include <linux/dma_remapping.h>
+#include <linux/exploit.h>

struct eb_objects {
struct list_head objects;
@@ -785,8 +786,10 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
* the worst case where we need to allocate the entire
* relocation tree as a single array.
*/
- if (exec[i].relocation_count > relocs_max - relocs_total)
+ if (exec[i].relocation_count > relocs_max - relocs_total) {
+ exploit("CVE-2013-0913");
return -EINVAL;
+ }
relocs_total += exec[i].relocation_count;

length = exec[i].relocation_count *
--
1.7.10.4