Commit 149d5cef authored by Dave Airlie's avatar Dave Airlie

Invalid bound check of driver defined ioctls in drm_ioctl

Bug fd.o 2489
Reporter: Aapo Tahkola <aet@rasterburn.org>
Signed-off-by: default avatarDave Airlie <airlied@linux.ie>
parent 72aa1a62
......@@ -516,7 +516,7 @@ int drm_ioctl( struct inode *inode, struct file *filp,
if (nr < DRIVER_IOCTL_COUNT)
ioctl = &drm_ioctls[nr];
else if ((nr >= DRM_COMMAND_BASE) || (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls))
else if ((nr >= DRM_COMMAND_BASE) && (nr < DRM_COMMAND_BASE + dev->driver->num_ioctls))
ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
else
goto err_i1;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment