From: Luca Barbieri Date: Sun, 10 Jan 2010 19:10:53 +0000 (+0100) Subject: drm/nouveau: check pushbuffer bounds in ioctl X-Git-Tag: v2.6.33-rc6~27^2~11^2 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=12f735b79f0ad63964dedabed3eee8a581bb66a5;p=pandora-kernel.git drm/nouveau: check pushbuffer bounds in ioctl Currently there is no check that the pushbuffer request bounds are inside the TTM BO. This allows to instruct the kernel to do relocations on user-selected addresses, since the relocation bounds checking relies on the request bounds. This can oops the kernel accidentally and is easily exploitable. This patch adds bound checking and alignment checking for ->offset and ->nr_dwords. It also makes some variables unsigned, which should have no effect, but prevents possible bounds checking problems. Signed-off-by: Luca Barbieri Signed-off-by: Ben Skeggs --- Reading git-diff-tree failed