diff options
| author | Eric Anholt | 2008-10-21 11:53:01 -0700 |
|---|---|---|
| committer | Dave Airlie | 2008-10-23 13:46:54 +1000 |
| commit | 7e78f72524b794fa8d73dc59aeeacc12a2e937fe (patch) | |
| tree | e04e6f5336d29ef58c75a829339e771210d904bc /drivers/gpu | |
| parent | 49568873705e45a0de77b7824a9a46d3201019a7 (diff) | |
drm: Avoid oops in DRM_IOCTL_RM_DRAW if a bad handle is supplied.
Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Michel Dänzer <michel@tungstengraphics.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/drm_drawable.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/gpu/drm/drm_drawable.c b/drivers/gpu/drm/drm_drawable.c index 4a794d89942b..80be1cab62af 100644 --- a/drivers/gpu/drm/drm_drawable.c +++ b/drivers/gpu/drm/drm_drawable.c @@ -81,6 +81,10 @@ int drm_rmdraw(struct drm_device *dev, void *data, struct drm_file *file_priv) spin_lock_irqsave(&dev->drw_lock, irqflags); info = drm_get_drawable_info(dev, draw->handle); + if (info == NULL) { + spin_unlock_irqrestore(&dev->drw_lock, irqflags); + return -EINVAL; + } drm_free(info->rects, info->num_rects * sizeof(struct drm_clip_rect), DRM_MEM_BUFS); drm_free(info, sizeof(struct drm_drawable_info), DRM_MEM_BUFS); |