drm/qxl: add missing access check for execbuffer ioctl

Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index a4b71b25fa53..a30f29425c21 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
                 if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
                         return -EINVAL;
 
+                if (!access_ok(VERIFY_READ,
+                               (void *)(unsigned long)user_cmd.command,
+                               user_cmd.command_size))
+                        return -EFAULT;
+
                 ret = qxl_alloc_release_reserved(qdev,
                                                  sizeof(union qxl_release_info) +
                                                  user_cmd.command_size,