Commit fefaedcf authored May 12, 2013 by Kees Cook Committed by Dave Airlie May 13, 2013

drm/radeon: check incoming cliprects pointer



The "boxes" parameter points into userspace memory. It should be verified
like any other operation against user memory.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>

parent 9f1d0366

drivers/gpu/drm/radeon/r300_cmdbuf.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -75,7 +75,7 @@ static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
		OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));

		for (i = 0; i < nr; ++i) {
		if (DRM_COPY_FROM_USER_UNCHECKED
		if (DRM_COPY_FROM_USER
		(&box, &cmdbuf->boxes[n + i], sizeof(box))) {
		DRM_ERROR("copy cliprect faulted\n");
		return -EFAULT;