drm/qxl: add missing access check for execbuffer ioctl

Reported-by: Mathieu Desnoyers <[e-mail]>
Signed-off-by: Dave Airlie <[e-mail]>

drivers/gpu/drm/qxl/qxl_ioctl.c

···
 		if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
 			return -EINVAL;
 
+		if (!access_ok(VERIFY_READ,
+			       (void *)(unsigned long)user_cmd.command,
+			       user_cmd.command_size))
+			return -EFAULT;
+
 		ret = qxl_alloc_release_reserved(qdev,
 						 sizeof(union qxl_release_info) +
 						 user_cmd.command_size,