OSDN Git Service
(root)
/
sagit-ice-cold
/
kernel_xiaomi_msm8998.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
426729d
)
drm/qxl: add missing access check for execbuffer ioctl
author
Dave Airlie
<airlied@redhat.com>
Fri, 28 Jun 2013 03:27:40 +0000
(13:27 +1000)
committer
Dave Airlie
<airlied@redhat.com>
Fri, 28 Jun 2013 03:27:40 +0000
(13:27 +1000)
Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/qxl/qxl_ioctl.c
patch
|
blob
|
history
diff --git
a/drivers/gpu/drm/qxl/qxl_ioctl.c
b/drivers/gpu/drm/qxl/qxl_ioctl.c
index
a4b71b2
..
a30f294
100644
(file)
--- a/
drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/
drivers/gpu/drm/qxl/qxl_ioctl.c
@@
-171,6
+171,11
@@
static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
return -EINVAL;
+ if (!access_ok(VERIFY_READ,
+ (void *)(unsigned long)user_cmd.command,
+ user_cmd.command_size))
+ return -EFAULT;
+
ret = qxl_alloc_release_reserved(qdev,
sizeof(union qxl_release_info) +
user_cmd.command_size,