diff options
Diffstat (limited to 'linux/drm_bufs.h')
| -rw-r--r-- | linux/drm_bufs.h | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/linux/drm_bufs.h b/linux/drm_bufs.h index 16af7bd5..02502321 100644 --- a/linux/drm_bufs.h +++ b/linux/drm_bufs.h @@ -332,6 +332,12 @@ int DRM(addbufs_agp)( struct inode *inode, struct file *filp, return -ENOMEM; /* May only call once for each order */ } + if (count < 0 || count > 4096) { + up( &dev->struct_sem ); + atomic_dec( &dev->buf_alloc ); + return -EINVAL; + } + entry->buflist = DRM(alloc)( count * sizeof(*entry->buflist), DRM_MEM_BUFS ); if ( !entry->buflist ) { @@ -479,6 +485,12 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp, return -ENOMEM; /* May only call once for each order */ } + if (count < 0 || count > 4096) { + up( &dev->struct_sem ); + atomic_dec( &dev->buf_alloc ); + return -EINVAL; + } + entry->buflist = DRM(alloc)( count * sizeof(*entry->buflist), DRM_MEM_BUFS ); if ( !entry->buflist ) { @@ -581,6 +593,7 @@ int DRM(addbufs_pci)( struct inode *inode, struct file *filp, atomic_dec( &dev->buf_alloc ); return 0; + } #endif /* __HAVE_PCI_DMA */ @@ -650,6 +663,12 @@ int DRM(addbufs_sg)( struct inode *inode, struct file *filp, return -ENOMEM; /* May only call once for each order */ } + if (count < 0 || count > 4096) { + up( &dev->struct_sem ); + atomic_dec( &dev->buf_alloc ); + return -EINVAL; + } + entry->buflist = DRM(alloc)( count * sizeof(*entry->buflist), DRM_MEM_BUFS ); if ( !entry->buflist ) { |