Hi, While hacking libdrm I triggered a kernel oups due to a non checked argument from user land. In nouveau_ioctl_notifier_alloc, nouveau_channel_get is invoked, but it doesn't validate the na->channel input argument. The attached patch validates the channel index, and change it's type to uint32_t since it is an index after all.
Cheers,
Michel
0001-Fix-channel-nouveau_channel_get-index-type-and-check.patch
Description: Binary data
_______________________________________________ Nouveau mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/nouveau
