Attachment 15732 Details for Bug 15382 – Null check order fixes, uninit

[patch] Null check order fixes, uninit

0001-Minor-bugfixes-e.g.-null-checking-after-deref-fixes.patch (text/plain), 3.63 KB, created by Roland "Test-tools" Bär on 2008-04-07 01:56:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Roland "Test-tools" Bär

Created: 2008-04-07 01:56:59 UTC

Size: 3.63 KB

patch

obsolete

>From 696c1c3e4669ac3d49d06388945fe70cf09399d5 Mon Sep 17 00:00:00 2001
>From: Roland Baer <roland@verifysoft.de>
>Date: Fri, 4 Apr 2008 16:48:57 +0300
>Subject: [PATCH] Minor bugfixes, e.g. null checking after deref fixes
>
>---
> linux-core/drm_memory.c   |    5 +++--
> linux-core/drm_vm.c       |    9 +++++----
> linux-core/i915_drv.c     |    8 +++++---
> linux-core/i915_execbuf.c |    2 +-
> 4 files changed, 14 insertions(+), 10 deletions(-)
>
>diff --git a/linux-core/drm_memory.c b/linux-core/drm_memory.c
>index 12e0141..a234033 100644
>--- a/linux-core/drm_memory.c
>+++ b/linux-core/drm_memory.c
>@@ -260,13 +260,14 @@ static void *agp_remap(unsigned long offset, unsigned long size,
> 	offset -= dev->hose->mem_space->start;
> #endif
> 
>+	if (!agpmem)
>+		return NULL;
>+
> 	list_for_each_entry(agpmem, &dev->agp->memory, head)
> 		if (agpmem->bound <= offset
> 		    && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
> 		    (offset + size))
> 			break;
>-	if (!agpmem)
>-		return NULL;
> 
> 	/*
> 	 * OK, we're mapping AGP space on a chipset/platform on which memory accesses by
>diff --git a/linux-core/drm_vm.c b/linux-core/drm_vm.c
>index ffda828..36ae8f8 100644
>--- a/linux-core/drm_vm.c
>+++ b/linux-core/drm_vm.c
>@@ -132,15 +132,15 @@ static __inline__ struct page *drm_do_vm_nopage(struct vm_area_struct *vma,
> 		/*
> 		 * It's AGP memory - find the real physical page to map
> 		 */
>+		if (!agpmem)
>+			goto vm_nopage_error;
>+
> 		list_for_each_entry(agpmem, &dev->agp->memory, head) {
> 			if (agpmem->bound <= baddr &&
> 			    agpmem->bound + agpmem->pages * PAGE_SIZE > baddr)
> 				break;
> 		}
> 
>-		if (!agpmem)
>-			goto vm_nopage_error;
>-
> 		/*
> 		 * Get the page, inc the use count, and return it
> 		 */
>@@ -848,10 +848,11 @@ static void drm_bo_vm_open(struct vm_area_struct *vma)
> static void drm_bo_vm_close(struct vm_area_struct *vma)
> {
> 	struct drm_buffer_object *bo = (struct drm_buffer_object *) vma->vm_private_data;
>-	struct drm_device *dev = bo->dev;
>+	struct drm_device *dev;
> 
> 	drm_vm_close(vma);
> 	if (bo) {
>+	        dev = bo->dev;
> 		mutex_lock(&dev->struct_mutex);
> #ifdef DRM_ODD_MM_COMPAT
> 		drm_bo_delete_vma(bo, vma);
>diff --git a/linux-core/i915_drv.c b/linux-core/i915_drv.c
>index e18bc8d..5323b54 100644
>--- a/linux-core/i915_drv.c
>+++ b/linux-core/i915_drv.c
>@@ -266,15 +266,17 @@ static void i915_restore_vga(struct drm_device *dev)
> 
> static int i915_suspend(struct drm_device *dev, pm_message_t state)
> {
>-	struct drm_i915_private *dev_priv = dev->dev_private;
>+	struct drm_i915_private *dev_priv;
> 	int i;
> 
>-	if (!dev || !dev_priv) {
>+	if (!dev || !dev->dev_private) {
> 		printk(KERN_ERR "dev: %p, dev_priv: %p\n", dev, dev_priv);
> 		printk(KERN_ERR "DRM not initialized, aborting suspend.\n");
> 		return -ENODEV;
> 	}
> 
>+	dev_priv = dev->dev_private;
>+
> 	if (state.event == PM_EVENT_PRETHAW)
> 		return 0;
> 
>@@ -542,7 +544,7 @@ static int i915_resume(struct drm_device *dev)
> 
> 	for (i = 0; i < 16; i++) {
> 		I915_WRITE(SWF0 + (i << 2), dev_priv->saveSWF0[i]);
>-		I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i+7]);
>+		I915_WRITE(SWF10 + (i << 2), dev_priv->saveSWF1[i+7]); /* FIXME, check array[16] overrun 15+7 ... */
> 	}
> 	for (i = 0; i < 3; i++)
> 		I915_WRITE(SWF30 + (i << 2), dev_priv->saveSWF2[i]);
>diff --git a/linux-core/i915_execbuf.c b/linux-core/i915_execbuf.c
>index 729ee0c..8508b1a 100644
>--- a/linux-core/i915_execbuf.c
>+++ b/linux-core/i915_execbuf.c
>@@ -481,7 +481,7 @@ static int i915_post_relocs(struct drm_file *file_priv,
> 	uint32_t __user *reloc_ptr;
> 	uint64_t new_reloc_data;
> 	uint32_t reloc_buf_size;
>-	uint32_t *reloc_buf;
>+	uint32_t *reloc_buf = NULL;
> 
> 	for (i = 0; i < num_buffers; ++i) {
> 		if (unlikely(!buffers[i].presumed_offset_correct)) {
>-- 
>1.5.4.3
>

Actions: View | Splinter Review

Attachments on bug 15382: 15732 | 15733

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.