Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754363Ab3COMcJ (ORCPT ); Fri, 15 Mar 2013 08:32:09 -0400 Received: from mga09.intel.com ([134.134.136.24]:26578 "EHLO mga09.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754183Ab3COMcH (ORCPT ); Fri, 15 Mar 2013 08:32:07 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.84,850,1355126400"; d="scan'208";a="302722407" Date: Fri, 15 Mar 2013 12:32:01 +0000 From: Damien Lespiau To: Kees Cook Cc: Daniel Vetter , Julien Tinnes , David Airlie , intel-gfx@lists.freedesktop.org, LKML , dri-devel@lists.freedesktop.org Subject: Re: [Intel-gfx] [PATCH v3] drm/i915: bounds check execbuffer relocation count Message-ID: <20130315123201.GA12828@dyon.amr.corp.intel.com> References: <20130312003145.GA28993@www.outflux.net> <20130312090746.GD31324@cantiga.alporthouse.com> <20130313202858.GD1896@bremse> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1867 Lines: 42 On Thu, Mar 14, 2013 at 12:32:00PM -0700, Kees Cook wrote: > On Thu, Mar 14, 2013 at 9:57 AM, Daniel Vetter wrote: > > On Wed, Mar 13, 2013 at 9:28 PM, Daniel Vetter wrote: > >> On Tue, Mar 12, 2013 at 09:07:46AM +0000, Chris Wilson wrote: > >>> On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees Cook wrote: > >>> > It is possible to wrap the counter used to allocate the buffer for > >>> > relocation copies. This could lead to heap writing overflows. > >>> > > >>> > CVE-2013-0913 > >>> > > >>> > v3: collapse test, improve comment > >>> > v2: move check into validate_exec_list > >>> > > >>> > Signed-off-by: Kees Cook > >>> > Reported-by: Pinkie Pie > >>> > Cc: stable@vger.kernel.org > >>> > >>> Looks good to me. The only bikeshed that remains is whether we should > >>> just collapse the two variables into one, but the current 'max - count' > >>> is more idiomatic and so preferrable. > >>> Reviewed-by: Chris Wilson > >> > >> Picked up for -fixes, thanks for the patch. > > > > I've forgotten to dump my wishlist: Can I have an i-g-t for this? For > > this bug here specifically an execbuf with just one buffer with too > > many relocs plus another execbuf with two buffers with relocation so > > that the 2nd relocation list will overflow should be sufficient. > > Sure thing. Where do these live? (Or what docs should I read for > this?) I'm assuming i-g-t means "intel graphics test"? :) Close :) GPU Tools. The tests lives in the tests directory of: http://cgit.freedesktop.org/xorg/app/intel-gpu-tools/ -- Damien -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/