drm/qxl: add missing access check for execbuffer ioctl
Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
parent
426729dcc7
commit
18097b91aa
|
@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
|
||||||
if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
|
if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
|
||||||
|
if (!access_ok(VERIFY_READ,
|
||||||
|
(void *)(unsigned long)user_cmd.command,
|
||||||
|
user_cmd.command_size))
|
||||||
|
return -EFAULT;
|
||||||
|
|
||||||
ret = qxl_alloc_release_reserved(qdev,
|
ret = qxl_alloc_release_reserved(qdev,
|
||||||
sizeof(union qxl_release_info) +
|
sizeof(union qxl_release_info) +
|
||||||
user_cmd.command_size,
|
user_cmd.command_size,
|
||||||
|
|
Loading…
Reference in New Issue