Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm/qxl fix from Dave Airlie:
"Bad me forgot an access check, possible security issue, but since this
is the first kernel with it, should be fine to just put it in now"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
drm/qxl: add missing access check for execbuffer ioctl
+5
+5
drivers/gpu/drm/qxl/qxl_ioctl.c
+5
drivers/gpu/drm/qxl/qxl_ioctl.c
···
171
171
if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
172
172
return -EINVAL;
173
173
174
+
if (!access_ok(VERIFY_READ,
175
+
(void *)(unsigned long)user_cmd.command,
176
+
user_cmd.command_size))
177
+
return -EFAULT;
178
+
174
179
ret = qxl_alloc_release_reserved(qdev,
175
180
sizeof(union qxl_release_info) +
176
181
user_cmd.command_size,