From: Eric Anholt <eric@anholt.net>
Date: Tue, 21 Oct 2008 18:53:01 +0000 (-0700)
Subject: drm: Avoid oops in DRM_IOCTL_RM_DRAW if a bad handle is supplied.
X-Git-Tag: firefly_0821_release~17136^2
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=7e78f72524b794fa8d73dc59aeeacc12a2e937fe;p=firefly-linux-kernel-4.4.55.git

drm: Avoid oops in DRM_IOCTL_RM_DRAW if a bad handle is supplied.

Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Michel Dänzer <michel@tungstengraphics.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
---

diff --git a/drivers/gpu/drm/drm_drawable.c b/drivers/gpu/drm/drm_drawable.c
index 4a794d89942b..80be1cab62af 100644
--- a/drivers/gpu/drm/drm_drawable.c
+++ b/drivers/gpu/drm/drm_drawable.c
@@ -81,6 +81,10 @@ int drm_rmdraw(struct drm_device *dev, void *data, struct drm_file *file_priv)
 	spin_lock_irqsave(&dev->drw_lock, irqflags);
 
 	info = drm_get_drawable_info(dev, draw->handle);
+	if (info == NULL) {
+		spin_unlock_irqrestore(&dev->drw_lock, irqflags);
+		return -EINVAL;
+	}
 	drm_free(info->rects, info->num_rects * sizeof(struct drm_clip_rect),
 			DRM_MEM_BUFS);
 	drm_free(info, sizeof(struct drm_drawable_info), DRM_MEM_BUFS);