diff options
| author | Dave Airlie <airlied@linux.ie> | 2004-04-21 12:18:42 +0000 |
|---|---|---|
| committer | Dave Airlie <airlied@linux.ie> | 2004-04-21 12:18:42 +0000 |
| commit | 2d9bbba0e10642a149297498c4e03fc43bac1280 (patch) | |
| tree | 9b53380800e68d484be0b94255e96d405889acaf /linux-core | |
| parent | 93bd67ef62e95a32f8b7e2fd7d9dadee52664160 (diff) | |
bug from Linux kernel list caught by checker
Diffstat (limited to 'linux-core')
| -rw-r--r-- | linux-core/i810_dma.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/linux-core/i810_dma.c b/linux-core/i810_dma.c index 651b0808..308d28eb 100644 --- a/linux-core/i810_dma.c +++ b/linux-core/i810_dma.c @@ -1275,12 +1275,14 @@ int i810_dma_mc(struct inode *inode, struct file *filp, if (copy_from_user(&mc, (drm_i810_mc_t *)arg, sizeof(mc))) return -EFAULT; - if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { DRM_ERROR("i810_dma_mc called without lock held\n"); return -EINVAL; } + if (mc.idx >= dma->buf_count || mc.idx < 0) + return -EINVAL; + i810_dma_dispatch_mc(dev, dma->buflist[mc.idx], mc.used, mc.last_render ); |