drm: Avoid oops in DRM_IOCTL_RM_DRAW if a bad handle is supplied.
Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Michel Dänzer <michel@tungstengraphics.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
diff --git a/drivers/gpu/drm/drm_drawable.c b/drivers/gpu/drm/drm_drawable.c
index 4a794d8..80be1ca 100644
--- a/drivers/gpu/drm/drm_drawable.c
+++ b/drivers/gpu/drm/drm_drawable.c
@@ -81,6 +81,10 @@
spin_lock_irqsave(&dev->drw_lock, irqflags);
info = drm_get_drawable_info(dev, draw->handle);
+ if (info == NULL) {
+ spin_unlock_irqrestore(&dev->drw_lock, irqflags);
+ return -EINVAL;
+ }
drm_free(info->rects, info->num_rects * sizeof(struct drm_clip_rect),
DRM_MEM_BUFS);
drm_free(info, sizeof(struct drm_drawable_info), DRM_MEM_BUFS);