releases/2.6.35.8/drm-radeon-kms-fix-potential-segfault-in-r600_ioctl_wait_idle.patch

   1 From e488459a0e131acc9e14df093cfee740bc431953 Mon Sep 17 00:00:00 2001
   2 From: Alex Deucher <alexdeucher@gmail.com>
   3 Date: Mon, 27 Sep 2010 10:57:10 -0400
   4 Subject: drm/radeon/kms: fix potential segfault in r600_ioctl_wait_idle
   5
   6 From: Alex Deucher <alexdeucher@gmail.com>
   7
   8 commit e488459a0e131acc9e14df093cfee740bc431953 upstream.
   9
  10 radeon_gem_wait_idle_ioctl can apparently get called prior to
  11 the vram page being set up or even if accel if false, so make
  12 sure it's valid before using it.
  13
  14 Should fix:
  15 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=597636
  16 https://bugs.freedesktop.org/show_bug.cgi?id=29834
  17
  18 Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
  19 Signed-off-by: Dave Airlie <airlied@redhat.com>
  20 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  21
  22 ---
  23  drivers/gpu/drm/radeon/r600.c |    3 ++-
  24  1 file changed, 2 insertions(+), 1 deletion(-)
  25
  26 --- a/drivers/gpu/drm/radeon/r600.c
  27 +++ b/drivers/gpu/drm/radeon/r600.c
  28 @@ -3522,7 +3522,8 @@ void r600_ioctl_wait_idle(struct radeon_
  29         /* r7xx hw bug.  write to HDP_DEBUG1 followed by fb read
  30          * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
  31          */
  32 -       if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740)) {
  33 +       if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740) &&
  34 +           rdev->vram_scratch.ptr) {
  35                 void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
  36                 u32 tmp;
  37