CHROMIUM: drm/i915: bounds check execbuffer relocations

It is possible to wrap the counter used to allocate the buffer for
relocation copies. This could lead to heap writing overflows.

BUG=chromium-os:39733
TEST=link build, PoC fails

[sending upstream]

Change-Id: Ifdd4ae846042852a4462d70cfa3c3b84d5a9d133
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/45118
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Stéphane Marchesin <marcheu@chromium.org>

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index de43194..a2aec8d 100644 (file)
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -936,6 +936,7 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
                   int count)
 {
        int i;
+       int total = 0;
 
        for (i = 0; i < count; i++) {
                char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
@@ -945,6 +946,9 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
                if (exec[i].relocation_count >
                    INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
                        return -EINVAL;
+               if (exec[i].relocation_count > INT_MAX - total)
+                       return -EINVAL;
+               total += exec[i].relocation_count;
 
                length = exec[i].relocation_count *
                        sizeof(struct drm_i915_gem_relocation_entry);