From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751243AbVK3OcY (ORCPT ); Wed, 30 Nov 2005 09:32:24 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751247AbVK3OcY (ORCPT ); Wed, 30 Nov 2005 09:32:24 -0500 Received: from cantor.suse.de ([195.135.220.2]:56977 "EHLO mx1.suse.de") by vger.kernel.org with ESMTP id S1751243AbVK3OcX (ORCPT ); Wed, 30 Nov 2005 09:32:23 -0500 Date: Wed, 30 Nov 2005 15:32:59 +0100 Message-ID: From: Takashi Iwai To: linux-kernel@vger.kernel.org Cc: Linus Torvalds Subject: [PATCH 2.6.15-rc3] Fix NULL-reference in DRM User-Agent: Wanderlust/2.12.0 (Your Wildest Dreams) SEMI/1.14.6 (Maruoka) FLIM/1.14.7 (=?ISO-8859-4?Q?Sanj=F2?=) APEL/10.6 MULE XEmacs/21.5 (beta21) (corn) (+CVS-20050720) (i386-suse-linux) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org This patch fixes the NULL pointer reference in DRM. SiS driver tries to allocate a big chunk of memory, but the return value is never checked. Reported in Novell bugzilla #132271: https://bugzilla.novell.com/show_bug.cgi?id=132271 From: Egbert Eich Signed-off-by: Takashi Iwai diff --git a/drivers/char/drm/drm_context.c b/drivers/char/drm/drm_context.c --- a/drivers/char/drm/drm_context.c +++ b/drivers/char/drm/drm_context.c @@ -432,7 +432,10 @@ int drm_addctx(struct inode *inode, stru if (ctx.handle != DRM_KERNEL_CONTEXT) { if (dev->driver->context_ctor) - dev->driver->context_ctor(dev, ctx.handle); + if (!dev->driver->context_ctor(dev, ctx.handle)) { + DRM_DEBUG( "Running out of ctxs or memory.\n"); + return -ENOMEM; + } } ctx_entry = drm_alloc(sizeof(*ctx_entry), DRM_MEM_CTXLIST);