[PATCH 2/2] drm/i915: fix integer overflow in i915_gem_do_execbuffer()

A large args->num_cliprects from userspace may overflow the allocation size, leading to out-of-bounds access. | i915_gem_do_execbuffer() | i915_gem_execbuffer() Use kmalloc_array() to avoid that. Signed-off-by: Xi Wang --- drivers/gpu/drm/i915/i915_gem_execbuffer.c |4 ++-- 1 files changed

[PATCH 2/2] drm/i915: fix integer overflow in i915_gem_do_execbuffer()

A large args->num_cliprects from userspace may overflow the allocation size, leading to out-of-bounds access. | i915_gem_do_execbuffer() | i915_gem_execbuffer() Use kmalloc_array() to avoid that. Signed-off-by: Xi Wang --- drivers/gpu/drm/i915/i915_gem_execbuffer.c |4 ++-- 1 files changed