diff options
| author | Johannes Weiner <hannes@saeurebad.de> | 2008-06-13 01:04:40 -0400 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2008-06-13 01:04:40 -0400 |
| commit | 41ee2ff404ec76194315aeed57ac973b010abe1d (patch) | |
| tree | feeee7f1004e44e84bb418decc58f41847c938a1 /drivers/char | |
| parent | 5dd34572ad9a3be430632dd42e4af2ea370b397b (diff) | |
drm: use drms ioctl cmd not what we get passed from userspace.
This enforces us to use the drm ioctl types so read/write works correctly and not believe
what userspace tells us.
It does this hopefully without breaking the drm api.
Fixes bug from thread: BUG: unable to handle kernel NULL pointer dereference (drm_getunique)
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/drm/drm_drv.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c index fc54140551a7..22957ac15df4 100644 --- a/drivers/char/drm/drm_drv.c +++ b/drivers/char/drm/drm_drv.c | |||
| @@ -475,6 +475,8 @@ int drm_ioctl(struct inode *inode, struct file *filp, | |||
| 475 | else | 475 | else |
| 476 | goto err_i1; | 476 | goto err_i1; |
| 477 | 477 | ||
| 478 | /* Do not trust userspace, use our own definition */ | ||
| 479 | cmd = ioctl->cmd; | ||
| 478 | func = ioctl->func; | 480 | func = ioctl->func; |
| 479 | /* is there a local override? */ | 481 | /* is there a local override? */ |
| 480 | if ((nr == DRM_IOCTL_NR(DRM_IOCTL_DMA)) && dev->driver->dma_ioctl) | 482 | if ((nr == DRM_IOCTL_NR(DRM_IOCTL_DMA)) && dev->driver->dma_ioctl) |