CVE request - kernel: drm: integer overflow in drm_mode_dirtyfb_ioctl()

[Eugene Teo <eugene () redhat com>]

There is a potential integer overflow in drm_mode_dirtyfb_ioctl() if
userspace passes in a large num_clips.  The call to kmalloc would
allocate a small buffer, and the call to fb->funcs->dirty may result in
a memory corruption.

Reported-by: Haogang Chen <haogangchen () gmail com>
Signed-off-by: Xi Wang <xi.wang () gmail com>

Upstream commit:
http://git.kernel.org/linus/a5cd335165e31db9dbab636fd29895d41da55dd2