Commit 7e78f725 authored by Eric Anholt's avatar Eric Anholt Committed by Dave Airlie

drm: Avoid oops in DRM_IOCTL_RM_DRAW if a bad handle is supplied.

Signed-off-by: default avatarEric Anholt <eric@anholt.net>
Acked-by: default avatarMichel Dänzer <michel@tungstengraphics.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent 49568873
...@@ -81,6 +81,10 @@ int drm_rmdraw(struct drm_device *dev, void *data, struct drm_file *file_priv) ...@@ -81,6 +81,10 @@ int drm_rmdraw(struct drm_device *dev, void *data, struct drm_file *file_priv)
spin_lock_irqsave(&dev->drw_lock, irqflags); spin_lock_irqsave(&dev->drw_lock, irqflags);
info = drm_get_drawable_info(dev, draw->handle); info = drm_get_drawable_info(dev, draw->handle);
if (info == NULL) {
spin_unlock_irqrestore(&dev->drw_lock, irqflags);
return -EINVAL;
}
drm_free(info->rects, info->num_rects * sizeof(struct drm_clip_rect), drm_free(info->rects, info->num_rects * sizeof(struct drm_clip_rect),
DRM_MEM_BUFS); DRM_MEM_BUFS);
drm_free(info, sizeof(struct drm_drawable_info), DRM_MEM_BUFS); drm_free(info, sizeof(struct drm_drawable_info), DRM_MEM_BUFS);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment