diff options
| author | Dave Airlie <airlied@redhat.com> | 2013-06-28 13:27:40 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2013-06-28 13:27:40 +1000 |
| commit | 18097b91aaff215e843f04b84ec2c686270bb55f (patch) | |
| tree | 236da0812c0bb7021e9c9f6f99648819d92bbad3 | |
| parent | 426729dcc713b3d1ae802e314030e5556a62da53 (diff) | |
| download | op-kernel-dev-18097b91aaff215e843f04b84ec2c686270bb55f.zip op-kernel-dev-18097b91aaff215e843f04b84ec2c686270bb55f.tar.gz | |
drm/qxl: add missing access check for execbuffer ioctl
Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
| -rw-r--r-- | drivers/gpu/drm/qxl/qxl_ioctl.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index a4b71b2..a30f294 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data, if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info)) return -EINVAL; + if (!access_ok(VERIFY_READ, + (void *)(unsigned long)user_cmd.command, + user_cmd.command_size)) + return -EFAULT; + ret = qxl_alloc_release_reserved(qdev, sizeof(union qxl_release_info) + user_cmd.command_size, |
