Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7e78f725 authored by Eric Anholt's avatar Eric Anholt Committed by Dave Airlie
Browse files

drm: Avoid oops in DRM_IOCTL_RM_DRAW if a bad handle is supplied. 



Signed-off-by: default avatarEric Anholt <eric@anholt.net>
Acked-by: default avatarMichel Dänzer <michel@tungstengraphics.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent 49568873

drivers/gpu/drm/drm_drawable.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -81,6 +81,10 @@ int drm_rmdraw(struct drm_device *dev, void *data, struct drm_file *file_priv) 
	spin_lock_irqsave(&dev->drw_lock, irqflags);

	spin_lock_irqsave(&dev->drw_lock, irqflags);





	info = drm_get_drawable_info(dev, draw->handle);

	info = drm_get_drawable_info(dev, draw->handle);

	if (info == NULL) {

		spin_unlock_irqrestore(&dev->drw_lock, irqflags);

		return -EINVAL;

	}

	drm_free(info->rects, info->num_rects * sizeof(struct drm_clip_rect),

	drm_free(info->rects, info->num_rects * sizeof(struct drm_clip_rect),

			DRM_MEM_BUFS);

			DRM_MEM_BUFS);

	drm_free(info, sizeof(struct drm_drawable_info), DRM_MEM_BUFS);

	drm_free(info, sizeof(struct drm_drawable_info), DRM_MEM_BUFS);