summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--linux-core/i810_dma.c4
-rw-r--r--linux/i810_dma.c4
2 files changed, 6 insertions, 2 deletions
diff --git a/linux-core/i810_dma.c b/linux-core/i810_dma.c
index 651b0808..308d28eb 100644
--- a/linux-core/i810_dma.c
+++ b/linux-core/i810_dma.c
@@ -1275,12 +1275,14 @@ int i810_dma_mc(struct inode *inode, struct file *filp,
if (copy_from_user(&mc, (drm_i810_mc_t *)arg, sizeof(mc)))
return -EFAULT;
-
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_dma_mc called without lock held\n");
return -EINVAL;
}
+ if (mc.idx >= dma->buf_count || mc.idx < 0)
+ return -EINVAL;
+
i810_dma_dispatch_mc(dev, dma->buflist[mc.idx], mc.used,
mc.last_render );
diff --git a/linux/i810_dma.c b/linux/i810_dma.c
index 651b0808..308d28eb 100644
--- a/linux/i810_dma.c
+++ b/linux/i810_dma.c
@@ -1275,12 +1275,14 @@ int i810_dma_mc(struct inode *inode, struct file *filp,
if (copy_from_user(&mc, (drm_i810_mc_t *)arg, sizeof(mc)))
return -EFAULT;
-
if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
DRM_ERROR("i810_dma_mc called without lock held\n");
return -EINVAL;
}
+ if (mc.idx >= dma->buf_count || mc.idx < 0)
+ return -EINVAL;
+
i810_dma_dispatch_mc(dev, dma->buflist[mc.idx], mc.used,
mc.last_render );