[PATCH 1/2] drm/i915: fix integer overflow in i915_gem_execbuffer2()

[Xi Wang]

A large args->buffer_count from userspace may overflow the allocation
size, leading to out-of-bounds access.

Use kmalloc_array() to avoid that.

Signed-off-by: Xi Wang <xi.wang at gmail.com>
---
 drivers/gpu/drm/i915/i915_gem_execbuffer.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c 
b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index f51a696..19962bd 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1409,8 +1409,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
                return -EINVAL;
        }

-       exec2_list = kmalloc(sizeof(*exec2_list)*args->buffer_count,
-                            GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
+       exec2_list = kmalloc_array(args->buffer_count, sizeof(*exec2_list),
+                                  GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY);
        if (exec2_list == NULL)
                exec2_list = drm_malloc_ab(sizeof(*exec2_list),
                                           args->buffer_count);
-- 
1.7.5.4