drm/radeon: check incoming cliprects pointer
authorKees Cook <keescook@chromium.org>
Mon, 13 May 2013 05:00:51 +0000 (22:00 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 19 May 2013 17:54:50 +0000 (10:54 -0700)
commitb58f2e1650eafddfdfcff2f4831bf2896f8c9bf6
tree5c68ea8972f59e519f0de57aa60780e34465a412
parent85e3025845566a5295bf91c514efb3fd640c1a56
drm/radeon: check incoming cliprects pointer

commit fefaedcfb82d2e57c2320acf60604ab03b750cc0 upstream.

The "boxes" parameter points into userspace memory. It should be verified
like any other operation against user memory.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/gpu/drm/radeon/r300_cmdbuf.c