[PATCH 2/2] drm/i915: fix integer overflow in i915_gem_do_execbuffer()

[Xi Wang]

A large args->num_cliprects from userspace may overflow the allocation
size, leading to out-of-bounds access.

| i915_gem_do_execbuffer()
| i915_gem_execbuffer()

Use kmalloc_array() to avoid that.

Signed-off-by: Xi Wang <xi.wang at gmail.com>
---
 drivers/gpu/drm/i915/i915_gem_execbuffer.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c 
b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 19962bd..607be3d 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1133,8 +1133,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                        return -EINVAL;
                }

-               cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects),
-                                   GFP_KERNEL);
+               cliprects = kmalloc_array(args->num_cliprects, 
sizeof(*cliprects),
+                                         GFP_KERNEL);
                if (cliprects == NULL) {
                        ret = -ENOMEM;
                        goto pre_mutex_err;
-- 
1.7.5.4