From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Kees Cook <keescook@chromium.org>,
Dave Airlie <airlied@redhat.com>
Subject: [ 32/33] drm/radeon: check incoming cliprects pointer
Date: Fri, 17 May 2013 14:50:16 -0700 [thread overview]
Message-ID: <20130517214920.334338181@linuxfoundation.org> (raw)
In-Reply-To: <20130517214916.821259930@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit fefaedcfb82d2e57c2320acf60604ab03b750cc0 upstream.
The "boxes" parameter points into userspace memory. It should be verified
like any other operation against user memory.
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/r300_cmdbuf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
+++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
@@ -74,7 +74,7 @@ static int r300_emit_cliprects(drm_radeo
OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
for (i = 0; i < nr; ++i) {
- if (DRM_COPY_FROM_USER_UNCHECKED
+ if (DRM_COPY_FROM_USER
(&box, &cmdbuf->boxes[n + i], sizeof(box))) {
DRM_ERROR("copy cliprect faulted\n");
return -EFAULT;
next prev parent reply other threads:[~2013-05-17 21:50 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-17 21:49 [ 00/33] 3.0.79-stable review Greg Kroah-Hartman
2013-05-17 21:49 ` [ 01/33] KVM: VMX: fix halt emulation while emulating invalid guest sate Greg Kroah-Hartman
2013-05-17 21:49 ` [ 02/33] ARM: OMAP: RX-51: change probe order of touchscreen and panel SPI devices Greg Kroah-Hartman
2013-05-17 21:49 ` [ 03/33] ASoC: wm8994: missing break in wm8994_aif3_hw_params() Greg Kroah-Hartman
2013-05-17 21:49 ` [ 04/33] ACPICA: Fix possible buffer overflow during a field unit read operation Greg Kroah-Hartman
2013-05-17 21:49 ` [ 05/33] dm snapshot: fix error return code in snapshot_ctr Greg Kroah-Hartman
2013-05-17 21:49 ` [ 06/33] xen/vcpu/pvhvm: Fix vcpu hotplugging hanging Greg Kroah-Hartman
2013-05-17 21:49 ` [ 07/33] SCSI: sd: fix array cache flushing bug causing performance problems Greg Kroah-Hartman
2013-05-17 21:49 ` [ 08/33] timer: Dont reinitialize the cpu base lock during CPU_UP_PREPARE Greg Kroah-Hartman
2013-05-17 21:49 ` [ 09/33] tick: Cleanup NOHZ per cpu data on cpu down Greg Kroah-Hartman
2013-05-17 21:49 ` [ 10/33] ext4: limit group search loop for non-extent files Greg Kroah-Hartman
2013-05-17 21:49 ` [ 11/33] ath9k: fix key allocation error handling for powersave keys Greg Kroah-Hartman
2013-05-17 21:49 ` [ 12/33] mwifiex: clear is_suspended flag when interrupt is received early Greg Kroah-Hartman
2013-05-17 21:49 ` [ 13/33] mwifiex: fix setting of multicast filter Greg Kroah-Hartman
2013-05-17 21:49 ` [ 14/33] drm/mm: fix dump table BUG Greg Kroah-Hartman
2013-05-17 21:49 ` [ 15/33] tcp: force a dst refcount when prequeue packet Greg Kroah-Hartman
2013-05-17 21:50 ` [ 16/33] 3c509.c: call SET_NETDEV_DEV for all device types (ISA/ISAPnP/EISA) Greg Kroah-Hartman
2013-05-17 21:50 ` [ 17/33] net_sched: act_ipt forward compat with xtables Greg Kroah-Hartman
2013-05-17 21:50 ` [ 18/33] bridge: fix race with topology change timer Greg Kroah-Hartman
2013-05-17 21:50 ` [ 19/33] 3c59x: fix freeing nonexistent resource on driver unload Greg Kroah-Hartman
2013-05-17 21:50 ` [ 20/33] 3c59x: fix PCI resource management Greg Kroah-Hartman
2013-05-17 21:50 ` [ 21/33] if_cablemodem.h: Add parenthesis around ioctl macros Greg Kroah-Hartman
2013-05-17 21:50 ` [ 22/33] macvlan: fix passthru mode race between dev removal and rx path Greg Kroah-Hartman
2013-05-17 21:50 ` [ 23/33] ipv6: do not clear pinet6 field Greg Kroah-Hartman
2013-05-17 21:50 ` [ 24/33] xfrm6: release dev before returning error Greg Kroah-Hartman
2013-05-17 21:50 ` [ 25/33] pch_dma: Use GFP_ATOMIC because called from interrupt context Greg Kroah-Hartman
2013-05-17 21:50 ` [ 26/33] r8169: fix vlan tag read ordering Greg Kroah-Hartman
2013-05-17 21:50 ` [ 27/33] drbd: fix for deadlock when using automatic split-brain-recovery Greg Kroah-Hartman
2013-05-17 21:50 ` [ 28/33] drivers/rtc/rtc-pcf2123.c: fix error return code in pcf2123_probe() Greg Kroah-Hartman
2013-05-17 21:50 ` [ 29/33] ACPI / EC: Restart transaction even when the IBF flag set Greg Kroah-Hartman
2013-05-17 21:50 ` [ 30/33] drivers/char/ipmi: memcpy, need additional 2 bytes to avoid memory overflow Greg Kroah-Hartman
2013-05-17 21:50 ` [ 31/33] ipmi: ipmi_devintf: compat_ioctl method fails to take ipmi_mutex Greg Kroah-Hartman
2013-05-17 21:50 ` Greg Kroah-Hartman [this message]
2013-05-17 21:50 ` [ 33/33] usermodehelper: check subprocess_info->path != NULL Greg Kroah-Hartman
2013-05-19 11:15 ` [ 00/33] 3.0.79-stable review Satoru Takeuchi
2013-05-19 17:07 ` Greg Kroah-Hartman
2013-05-19 17:09 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130517214920.334338181@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=airlied@redhat.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox