diff options
| author | David S. Miller <davem@davemloft.net> | 2013-07-03 14:50:41 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-07-03 14:55:13 -0700 |
| commit | 0c1072ae0242fbdffd9a0bba36e7a7033d287f9c (patch) | |
| tree | e0f4dbdbf5078d4a707911177e7bdc17a70bdce5 /drivers/gpu/drm/qxl/qxl_ioctl.c | |
| parent | c50cd357887acf9fd7af3a5d492911bd825555a2 (diff) | |
| parent | 8bb495e3f02401ee6f76d1b1d77f3ac9f079e376 (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Conflicts:
drivers/net/ethernet/freescale/fec_main.c
drivers/net/ethernet/renesas/sh_eth.c
net/ipv4/gre.c
The GRE conflict is between a bug fix (kfree_skb --> kfree_skb_list)
and the splitting of the gre.c code into seperate files.
The FEC conflict was two sets of changes adding ethtool support code
in an "!CONFIG_M5272" CPP protected block.
Finally the sh_eth.c conflict was between one commit add bits set
in the .eesr_err_check mask whilst another commit removed the
.tx_error_check member and assignments.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/gpu/drm/qxl/qxl_ioctl.c')
| -rw-r--r-- | drivers/gpu/drm/qxl/qxl_ioctl.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index a4b71b25fa53..a30f29425c21 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data, if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info)) return -EINVAL; + if (!access_ok(VERIFY_READ, + (void *)(unsigned long)user_cmd.command, + user_cmd.command_size)) + return -EFAULT; + ret = qxl_alloc_release_reserved(qdev, sizeof(union qxl_release_info) + user_cmd.command_size, |