linux-kernel - Re: [PATCH v3] drm/i915: bounds check execbuffer relocation count

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKMK7uEDjtECnAO1v38KMDuB7kd=DthiZRvQdto7+HJ19tWkEw@mail.gmail.com>
Date:	Thu, 14 Mar 2013 17:57:31 +0100
From:	Daniel Vetter <daniel.vetter@...ll.ch>
To:	Chris Wilson <chris@...is-wilson.co.uk>,
	Kees Cook <keescook@...omium.org>,
	linux-kernel@...r.kernel.org,
	Daniel Vetter <daniel.vetter@...ll.ch>,
	David Airlie <airlied@...ux.ie>,
	dri-devel@...ts.freedesktop.org, intel-gfx@...ts.freedesktop.org,
	Julien Tinnes <jln@...gle.com>, marcheu@...omium.org
Subject: Re: [PATCH v3] drm/i915: bounds check execbuffer relocation count

On Wed, Mar 13, 2013 at 9:28 PM, Daniel Vetter <daniel@...ll.ch> wrote:
> On Tue, Mar 12, 2013 at 09:07:46AM +0000, Chris Wilson wrote:
>> On Mon, Mar 11, 2013 at 05:31:45PM -0700, Kees Cook wrote:
>> > It is possible to wrap the counter used to allocate the buffer for
>> > relocation copies. This could lead to heap writing overflows.
>> >
>> > CVE-2013-0913
>> >
>> > v3: collapse test, improve comment
>> > v2: move check into validate_exec_list
>> >
>> > Signed-off-by: Kees Cook <keescook@...omium.org>
>> > Reported-by: Pinkie Pie
>> > Cc: stable@...r.kernel.org
>>
>> Looks good to me. The only bikeshed that remains is whether we should
>> just collapse the two variables into one, but the current 'max - count'
>> is more idiomatic and so preferrable.
>> Reviewed-by: Chris Wilson <chris@...is-wilson.co.uk>
>
> Picked up for -fixes, thanks for the patch.

I've forgotten to dump my wishlist: Can I have an i-g-t for this? For
this bug here specifically an execbuf with just one buffer with too
many relocs plus another execbuf with two buffers with relocation so
that the 2nd relocation list will overflow should be sufficient.

Cheers, Daniel
-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/