From patchwork Sat Jan 23 20:26:35 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 74912 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by demeter.kernel.org (8.14.3/8.14.2) with ESMTP id o0NKQj4j021513 for ; Sat, 23 Jan 2010 20:26:45 GMT Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D118F9E7A9; Sat, 23 Jan 2010 12:26:43 -0800 (PST) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from orsmga101.jf.intel.com (mga06.intel.com [134.134.136.21]) by gabe.freedesktop.org (Postfix) with ESMTP id 055F89E772 for ; Sat, 23 Jan 2010 12:26:41 -0800 (PST) Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga101.jf.intel.com with ESMTP; 23 Jan 2010 12:25:53 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.49,330,1262592000"; d="scan'208";a="589828611" Received: from unknown (HELO localhost.localdomain) ([10.255.17.149]) by orsmga001.jf.intel.com with ESMTP; 23 Jan 2010 12:26:34 -0800 From: Chris Wilson To: intel-gfx@lists.freedesktop.org Date: Sat, 23 Jan 2010 20:26:35 +0000 Message-Id: <1264278395-18235-1-git-send-email-chris@chris-wilson.co.uk> X-Mailer: git-send-email 1.6.6 Subject: [Intel-gfx] [PATCH] drm/i915: Prevent use of uninitialized pointers along error path. X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: intel-gfx-bounces@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 634acc8..eb6f3ef 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -3742,6 +3742,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, if (object_list[i] == NULL) { DRM_ERROR("Invalid object handle %d at index %d\n", exec_list[i].handle, i); + /* prevent error path from reading uninitialized data */ + args->buffer_count = i + 1; ret = -EBADF; goto err; } @@ -3750,6 +3752,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, if (obj_priv->in_execbuffer) { DRM_ERROR("Object %p appears more than once in object list\n", object_list[i]); + /* prevent error path from reading uninitialized data */ + args->buffer_count = i + 1; ret = -EBADF; goto err; }