Commit c4814f90 authored by Michel Dänzer's avatar Michel Dänzer Committed by Dave Airlie

drm: make sure the drawable code doesn't call malloc(0).

Signed-off-by: default avatarMichel Dänzer <michel@tungstengraphics.com>
Signed-off-by: default avatarDave Airlie <airlied@linux.ie>
parent 777c7738
...@@ -172,28 +172,38 @@ int drm_rmdraw(DRM_IOCTL_ARGS) ...@@ -172,28 +172,38 @@ int drm_rmdraw(DRM_IOCTL_ARGS)
bitfield_length = idx + 1; bitfield_length = idx + 1;
if (idx != id / (8 * sizeof(*bitfield))) bitfield = NULL;
if (bitfield_length) {
if (bitfield_length != dev->drw_bitfield_length)
bitfield = drm_alloc(bitfield_length * bitfield = drm_alloc(bitfield_length *
sizeof(*bitfield), DRM_MEM_BUFS); sizeof(*bitfield),
DRM_MEM_BUFS);
if (!bitfield && bitfield_length) { if (!bitfield) {
bitfield = dev->drw_bitfield; bitfield = dev->drw_bitfield;
bitfield_length = dev->drw_bitfield_length; bitfield_length = dev->drw_bitfield_length;
} }
} }
}
if (bitfield != dev->drw_bitfield) { if (bitfield != dev->drw_bitfield) {
info_length = 8 * sizeof(*bitfield) * bitfield_length; info_length = 8 * sizeof(*bitfield) * bitfield_length;
info = drm_alloc(info_length * sizeof(*info), DRM_MEM_BUFS); if (info_length) {
info = drm_alloc(info_length * sizeof(*info),
DRM_MEM_BUFS);
if (!info && info_length) { if (!info) {
info = dev->drw_info; info = dev->drw_info;
info_length = dev->drw_info_length; info_length = dev->drw_info_length;
} }
} else
info = NULL;
spin_lock_irqsave(&dev->drw_lock, irqflags); spin_lock_irqsave(&dev->drw_lock, irqflags);
if (bitfield)
memcpy(bitfield, dev->drw_bitfield, bitfield_length * memcpy(bitfield, dev->drw_bitfield, bitfield_length *
sizeof(*bitfield)); sizeof(*bitfield));
drm_free(dev->drw_bitfield, sizeof(*bitfield) * drm_free(dev->drw_bitfield, sizeof(*bitfield) *
...@@ -202,6 +212,7 @@ int drm_rmdraw(DRM_IOCTL_ARGS) ...@@ -202,6 +212,7 @@ int drm_rmdraw(DRM_IOCTL_ARGS)
dev->drw_bitfield_length = bitfield_length; dev->drw_bitfield_length = bitfield_length;
if (info != dev->drw_info) { if (info != dev->drw_info) {
if (info)
memcpy(info, dev->drw_info, info_length * memcpy(info, dev->drw_info, info_length *
sizeof(*info)); sizeof(*info));
drm_free(dev->drw_info, sizeof(*info) * drm_free(dev->drw_info, sizeof(*info) *
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment