From: <dar...@ke...> - 2006-11-17 23:10:08
|
shared-core/nouveau_fifo.c | 6 +++++- shared-core/nouveau_object.c | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) New commits: diff-tree 9ac7a8b0b4c0431b605c3f8d0b4a696903010c51 (from e9194dd1b068666dd94e73d95dc3cd031a89a6b7) Author: Ben Skeggs <dar...@ii...> Date: Sat Nov 18 10:09:29 2006 +1100 Only return FIFO number if the FIFO is marked as in use.. diff --git a/shared-core/nouveau_fifo.c b/shared-core/nouveau_fifo.c index 441bde4..b6fc613 100644 --- a/shared-core/nouveau_fifo.c +++ b/shared-core/nouveau_fifo.c @@ -564,7 +564,7 @@ int nouveau_fifo_id_get(drm_device_t* de int i; for(i=0;i<nouveau_fifo_number(dev);i++) - if (dev_priv->fifos[i].filp == filp) + if (dev_priv->fifos[i].used && dev_priv->fifos[i].filp == filp) return i; return -1; } diff-tree e9194dd1b068666dd94e73d95dc3cd031a89a6b7 (from 18bba3fa29187bb5122ed057989203dc05bc46aa) Author: Ben Skeggs <dar...@ii...> Date: Sat Nov 18 10:03:45 2006 +1100 Check some return vals, fixes a couple of oopses. diff --git a/shared-core/nouveau_fifo.c b/shared-core/nouveau_fifo.c index 73c4e9f..441bde4 100644 --- a/shared-core/nouveau_fifo.c +++ b/shared-core/nouveau_fifo.c @@ -403,6 +403,10 @@ static int nouveau_fifo_alloc(drm_device NV_DMA_ACCESS_RO, NV_DMA_TARGET_VIDMEM); } + if (!cb_obj) { + DRM_ERROR("unable to alloc object for command buffer\n"); + return DRM_ERR(EINVAL); + } dev_priv->fifos[i].cmdbuf_obj = cb_obj; /* that fifo is used */ diff --git a/shared-core/nouveau_object.c b/shared-core/nouveau_object.c index abd8bec..0db92ec 100644 --- a/shared-core/nouveau_object.c +++ b/shared-core/nouveau_object.c @@ -523,6 +523,8 @@ int nouveau_ioctl_object_init(DRM_IOCTL_ int fifo; fifo = nouveau_fifo_id_get(dev, filp); + if (fifo == -1) + return DRM_ERR(EINVAL); DRM_COPY_FROM_USER_IOCTL(init, (drm_nouveau_object_init_t __user *) data, sizeof(init)); @@ -577,6 +579,8 @@ int nouveau_ioctl_dma_object_init(DRM_IO int fifo; fifo = nouveau_fifo_id_get(dev, filp); + if (fifo == -1) + return DRM_ERR(EINVAL); DRM_COPY_FROM_USER_IOCTL(init, (drm_nouveau_dma_object_init_t __user *) data, sizeof(init)); |