Commit c96e7c7a authored by Roel Kluin's avatar Roel Kluin Committed by Dave Airlie

drm/ttm: Read buffer overflow

Check whether index is within bounds before grabbing the element.
Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent fa99239c
...@@ -1182,13 +1182,14 @@ static int ttm_bo_force_list_clean(struct ttm_bo_device *bdev, ...@@ -1182,13 +1182,14 @@ static int ttm_bo_force_list_clean(struct ttm_bo_device *bdev,
int ttm_bo_clean_mm(struct ttm_bo_device *bdev, unsigned mem_type) int ttm_bo_clean_mm(struct ttm_bo_device *bdev, unsigned mem_type)
{ {
struct ttm_mem_type_manager *man = &bdev->man[mem_type]; struct ttm_mem_type_manager *man;
int ret = -EINVAL; int ret = -EINVAL;
if (mem_type >= TTM_NUM_MEM_TYPES) { if (mem_type >= TTM_NUM_MEM_TYPES) {
printk(KERN_ERR TTM_PFX "Illegal memory type %d\n", mem_type); printk(KERN_ERR TTM_PFX "Illegal memory type %d\n", mem_type);
return ret; return ret;
} }
man = &bdev->man[mem_type];
if (!man->has_type) { if (!man->has_type) {
printk(KERN_ERR TTM_PFX "Trying to take down uninitialized " printk(KERN_ERR TTM_PFX "Trying to take down uninitialized "
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment