git.openpandora.org / pandora-kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 694da87) | patch
drm/radeon: check incoming cliprects pointer
authorKees Cook <keescook@chromium.org>
Mon, 13 May 2013 05:00:51 +0000 (22:00 -0700)
committerBen Hutchings <ben@decadent.org.uk>
Thu, 30 May 2013 13:34:57 +0000 (14:34 +0100)
commit05172d75318ab9c583895576acb24c62382f60fe
treea4cada3e79738a5ffed6145135214d1973145c93tree | snapshot
parent694da87f929f867afe14efcc5683bc652dca4da8commit | diff
drm/radeon: check incoming cliprects pointer

commit fefaedcfb82d2e57c2320acf60604ab03b750cc0 upstream.

The "boxes" parameter points into userspace memory. It should be verified
like any other operation against user memory.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/gpu/drm/radeon/r300_cmdbuf.c diff | blob | history
Pandora Kernel Repository