lkml.org 
[lkml]   [2013]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[54/65] drm/radeon: check incoming cliprects pointer
    3.6.11.5 stable review patch.
    If anyone has any objections, please let me know.

    ------------------

    From: Kees Cook <keescook@chromium.org>

    [ Upstream commit fefaedcfb82d2e57c2320acf60604ab03b750cc0 ]

    The "boxes" parameter points into userspace memory. It should be verified
    like any other operation against user memory.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    ---
    drivers/gpu/drm/radeon/r300_cmdbuf.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
    index 1fe98b4..9aa02be 100644
    --- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
    +++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
    @@ -74,7 +74,7 @@ static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
    OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));

    for (i = 0; i < nr; ++i) {
    - if (DRM_COPY_FROM_USER_UNCHECKED
    + if (DRM_COPY_FROM_USER
    (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
    DRM_ERROR("copy cliprect faulted\n");
    return -EFAULT;
    --
    1.7.10.4



    \
     
     \ /
      Last update: 2013-06-04 01:21    [W:4.251 / U:0.204 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site