Xi Wang ed8cd3b2cd drm/i915: fix integer overflow in i915_gem_execbuffer2() ... On 32-bit systems, a large args->buffer_count from userspace via ioctl may overflow the allocation size, leading to out-of-bounds access. This vulnerability was introduced in commit 8408c282 ("drm/i915: First try a normal large kmalloc for the temporary exec buffers"). Signed-off-by: Xi Wang <xi.wang@gmail.com> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>		2012-04-23 22:32:02 +02:00
..
drm	drm/i915: fix integer overflow in i915_gem_execbuffer2()	2012-04-23 22:32:02 +02:00
stub	i915: select VIDEO_OUTPUT_CONTROL for ACPI_VIDEO	2011-04-13 09:10:25 +10:00
vga	drivers/gpu/vga/vgaarb.c: add missing kfree	2011-11-22 20:21:10 +00:00
Makefile	gpu: Add Intel GMA500(Poulsbo) Stub Driver	2010-10-26 11:00:13 +10:00