lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

drm/vmwgfx: Fix an error path causing an oops.

Browse Source 
An error happening before the snooper.image member had been set up
would cause a kfree of an arbitrary pointer. Set up the snooper.image
member early.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
This commit is contained in:
Thomas Hellstrom
2010-01-13 22:28:37 +01:00
committed by Dave Airlie
parent df1c93bae2
commit 50ec3b7c35
1 changed files with 21 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
View File

@@ -599,6 +599,27 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
if (unlikely(ret != 0)) if (unlikely(ret != 0))
goto out_err1; goto out_err1;
if (srf->flags & (1 << 9) &&
srf->num_sizes == 1 &&
srf->sizes[0].width == 64 &&
srf->sizes[0].height == 64 &&
srf->format == SVGA3D_A8R8G8B8) {
srf->snooper.image = kmalloc(64 * 64 * 4, GFP_KERNEL);
/* clear the image */
if (srf->snooper.image) {
memset(srf->snooper.image, 0x00, 64 * 64 * 4);
} else {
DRM_ERROR("Failed to allocate cursor_image\n");
ret = -ENOMEM;
goto out_err1;
}
} else {
srf->snooper.image = NULL;
}
srf->snooper.crtc = NULL;
user_srf->base.shareable = false; user_srf->base.shareable = false;
user_srf->base.tfile = NULL; user_srf->base.tfile = NULL;
@@ -622,24 +643,6 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
return ret; return ret;
} }
if (srf->flags & (1 << 9) &&
srf->num_sizes == 1 &&
srf->sizes[0].width == 64 &&
srf->sizes[0].height == 64 &&
srf->format == SVGA3D_A8R8G8B8) {
srf->snooper.image = kmalloc(64 * 64 * 4, GFP_KERNEL);
/* clear the image */
if (srf->snooper.image)
memset(srf->snooper.image, 0x00, 64 * 64 * 4);
else
DRM_ERROR("Failed to allocate cursor_image\n");
} else {
srf->snooper.image = NULL;
}
srf->snooper.crtc = NULL;
rep->sid = user_srf->base.hash.key; rep->sid = user_srf->base.hash.key;
if (rep->sid == SVGA3D_INVALID_ID) if (rep->sid == SVGA3D_INVALID_ID)
DRM_ERROR("Created bad Surface ID.\n"); DRM_ERROR("Created bad Surface ID.\n");