[PATCH 42/49] dirtyfb

[Chris Wilson]

---
 drivers/gpu/drm/drm_framebuffer.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index af786f27f72e..8087c5116451 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -504,10 +504,13 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
 	}
 
 	if (num_clips && clips_ptr) {
+		int i;
+
 		if (num_clips < 0 || num_clips > DRM_MODE_FB_DIRTY_MAX_CLIPS) {
 			ret = -EINVAL;
 			goto out_err1;
 		}
+
 		clips = kcalloc(num_clips, sizeof(*clips), GFP_KERNEL);
 		if (!clips) {
 			ret = -ENOMEM;
@@ -520,6 +523,14 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
 			ret = -EFAULT;
 			goto out_err2;
 		}
+
+		for (i = 0; i < num_clips; i++) {
+			if (clips[i].x2 < clips[i].x1 ||
+			    clips[i].y2 < clips[i].y1) {
+				ret = -EINVAL;
+				goto out_err2;
+			}
+		}
 	}
 
 	if (fb->funcs->dirty) {
-- 
2.10.2