drm: Avoid oops in DRM_IOCTL_RM_DRAW if a bad handle is supplied.
authorEric Anholt <eric@anholt.net>
Tue, 21 Oct 2008 18:53:01 +0000 (11:53 -0700)
committerDave Airlie <airlied@redhat.com>
Thu, 23 Oct 2008 03:46:54 +0000 (13:46 +1000)
Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Michel Dänzer <michel@tungstengraphics.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
drivers/gpu/drm/drm_drawable.c

index 4a794d89942bc34261eeeee1bd8d5e5b29ebf5a3..80be1cab62afe77bc386bb39f1e0ca92113e4206 100644 (file)
@@ -81,6 +81,10 @@ int drm_rmdraw(struct drm_device *dev, void *data, struct drm_file *file_priv)
        spin_lock_irqsave(&dev->drw_lock, irqflags);
 
        info = drm_get_drawable_info(dev, draw->handle);
+       if (info == NULL) {
+               spin_unlock_irqrestore(&dev->drw_lock, irqflags);
+               return -EINVAL;
+       }
        drm_free(info->rects, info->num_rects * sizeof(struct drm_clip_rect),
                        DRM_MEM_BUFS);
        drm_free(info, sizeof(struct drm_drawable_info), DRM_MEM_BUFS);