drm/radeon: check incoming cliprects pointer
The "boxes" parameter points into userspace memory. It should be verified like any other operation against user memory. Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
parent
9f1d036648
commit
fefaedcfb8
|
@ -75,7 +75,7 @@ static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
|
||||||
OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
|
OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
|
||||||
|
|
||||||
for (i = 0; i < nr; ++i) {
|
for (i = 0; i < nr; ++i) {
|
||||||
if (DRM_COPY_FROM_USER_UNCHECKED
|
if (DRM_COPY_FROM_USER
|
||||||
(&box, &cmdbuf->boxes[n + i], sizeof(box))) {
|
(&box, &cmdbuf->boxes[n + i], sizeof(box))) {
|
||||||
DRM_ERROR("copy cliprect faulted\n");
|
DRM_ERROR("copy cliprect faulted\n");
|
||||||
return -EFAULT;
|
return -EFAULT;
|
||||||
|
|
Loading…
Reference in a new issue