drm: fix NULL pointer access by wrong ioctl
authorZhaowei Yuan <zhaowei.yuan@samsung.com>
Wed, 18 Jun 2014 06:33:59 +0000 (14:33 +0800)
committerBen Hutchings <ben@decadent.org.uk>
Fri, 11 Jul 2014 12:33:55 +0000 (13:33 +0100)
commit2c1ec4bfa383ddf85459a3c299db27377ac537d0
tree58563470035b059135bb44d9fc84493479f5cea9
parente0b2508d7d22cca58322a7d29f6339df0c01bf54
drm: fix NULL pointer access by wrong ioctl

commit 1539fb9bd405ee32282ea0a38404f9e008ac5b7a upstream.

If user uses wrong ioctl command with _IOC_NONE and argument size
greater than 0, it can cause NULL pointer access from memset of line
463. If _IOC_NONE, don't memset to 0 for kdata.

Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
[bwh: Backported to 3.2: adjust indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/gpu/drm/drm_drv.c