drm/qxl: add missing access check for execbuffer ioctl

Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index a4b71b25fa5366c948f8447e6c7b6f0808b4aab4..a30f29425c216afb5f4983a9be32210355c8e37d 100644 (file)
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
                if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
                        return -EINVAL;
 
+               if (!access_ok(VERIFY_READ,
+                              (void *)(unsigned long)user_cmd.command,
+                              user_cmd.command_size))
+                       return -EFAULT;
+
                ret = qxl_alloc_release_reserved(qdev,
                                                 sizeof(union qxl_release_info) +
                                                 user_cmd.command_size,