summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/drm_drawable.c
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/gpu/drm/drm_drawable.c')
-rw-r--r--drivers/gpu/drm/drm_drawable.c15
1 files changed, 12 insertions, 3 deletions
diff --git a/drivers/gpu/drm/drm_drawable.c b/drivers/gpu/drm/drm_drawable.c
index 1839c57663c5..80be1cab62af 100644
--- a/drivers/gpu/drm/drm_drawable.c
+++ b/drivers/gpu/drm/drm_drawable.c
@@ -76,11 +76,18 @@ int drm_rmdraw(struct drm_device *dev, void *data, struct drm_file *file_priv)
{
struct drm_draw *draw = data;
unsigned long irqflags;
+ struct drm_drawable_info *info;
spin_lock_irqsave(&dev->drw_lock, irqflags);
- drm_free(drm_get_drawable_info(dev, draw->handle),
- sizeof(struct drm_drawable_info), DRM_MEM_BUFS);
+ info = drm_get_drawable_info(dev, draw->handle);
+ if (info == NULL) {
+ spin_unlock_irqrestore(&dev->drw_lock, irqflags);
+ return -EINVAL;
+ }
+ drm_free(info->rects, info->num_rects * sizeof(struct drm_clip_rect),
+ DRM_MEM_BUFS);
+ drm_free(info, sizeof(struct drm_drawable_info), DRM_MEM_BUFS);
idr_remove(&dev->drw_idr, draw->handle);
@@ -111,7 +118,9 @@ int drm_update_drawable_info(struct drm_device *dev, void *data, struct drm_file
switch (update->type) {
case DRM_DRAWABLE_CLIPRECTS:
- if (update->num != info->num_rects) {
+ if (update->num == 0)
+ rects = NULL;
+ else if (update->num != info->num_rects) {
rects = drm_alloc(update->num * sizeof(struct drm_clip_rect),
DRM_MEM_BUFS);
} else