diff options
| -rw-r--r-- | shared-core/nouveau_fifo.c | 4 | ||||
| -rw-r--r-- | shared-core/nouveau_object.c | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/shared-core/nouveau_fifo.c b/shared-core/nouveau_fifo.c index 73c4e9f9..441bde40 100644 --- a/shared-core/nouveau_fifo.c +++ b/shared-core/nouveau_fifo.c @@ -403,6 +403,10 @@ static int nouveau_fifo_alloc(drm_device_t* dev,drm_nouveau_fifo_alloc_t* init, NV_DMA_ACCESS_RO, NV_DMA_TARGET_VIDMEM); } + if (!cb_obj) { + DRM_ERROR("unable to alloc object for command buffer\n"); + return DRM_ERR(EINVAL); + } dev_priv->fifos[i].cmdbuf_obj = cb_obj; /* that fifo is used */ diff --git a/shared-core/nouveau_object.c b/shared-core/nouveau_object.c index abd8bec5..0db92ec4 100644 --- a/shared-core/nouveau_object.c +++ b/shared-core/nouveau_object.c @@ -523,6 +523,8 @@ int nouveau_ioctl_object_init(DRM_IOCTL_ARGS) int fifo; fifo = nouveau_fifo_id_get(dev, filp); + if (fifo == -1) + return DRM_ERR(EINVAL); DRM_COPY_FROM_USER_IOCTL(init, (drm_nouveau_object_init_t __user *) data, sizeof(init)); @@ -577,6 +579,8 @@ int nouveau_ioctl_dma_object_init(DRM_IOCTL_ARGS) int fifo; fifo = nouveau_fifo_id_get(dev, filp); + if (fifo == -1) + return DRM_ERR(EINVAL); DRM_COPY_FROM_USER_IOCTL(init, (drm_nouveau_dma_object_init_t __user *) data, sizeof(init)); |