From 18097b91aaff215e843f04b84ec2c686270bb55f Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Fri, 28 Jun 2013 13:27:40 +1000 Subject: [PATCH] drm/qxl: add missing access check for execbuffer ioctl Reported-by: Mathieu Desnoyers Signed-off-by: Dave Airlie --- drivers/gpu/drm/qxl/qxl_ioctl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index a4b71b25fa53..a30f29425c21 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data, if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info)) return -EINVAL; + if (!access_ok(VERIFY_READ, + (void *)(unsigned long)user_cmd.command, + user_cmd.command_size)) + return -EFAULT; + ret = qxl_alloc_release_reserved(qdev, sizeof(union qxl_release_info) + user_cmd.command_size, -- 2.20.1