Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18097b91 authored by Dave Airlie's avatar Dave Airlie
Browse files

drm/qxl: add missing access check for execbuffer ioctl 



Reported-by: default avatarMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent 426729dc

drivers/gpu/drm/qxl/qxl_ioctl.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data, 
		if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))

		if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))

			return -EINVAL;

			return -EINVAL;





		if (!access_ok(VERIFY_READ,

			       (void *)(unsigned long)user_cmd.command,

			       user_cmd.command_size))

			return -EFAULT;



		ret = qxl_alloc_release_reserved(qdev,

		ret = qxl_alloc_release_reserved(qdev,

						 sizeof(union qxl_release_info) +

						 sizeof(union qxl_release_info) +

						 user_cmd.command_size,

						 user_cmd.command_size,