aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorThomas White <taw@bitwiz.org.uk>2009-09-09 15:41:02 +0100
committerThomas White <taw@bitwiz.org.uk>2009-09-09 15:41:02 +0100
commitf0f4bd790d1f6409084d9a1a79beba1d7a8baf7d (patch)
treeccf238c2158d343ad259bcb77862e77160c02fa0
parent4c4019bcdb3de577846384a519be08b5059cf4c2 (diff)
Sanitise size and alignment of GEM objects
Signed-off-by: Thomas White <taw@bitwiz.org.uk>
-rw-r--r--drivers/mfd/glamo/glamo-buffer.c14
1 files changed, 12 insertions, 2 deletions
diff --git a/drivers/mfd/glamo/glamo-buffer.c b/drivers/mfd/glamo/glamo-buffer.c
index ae8eeadb25a..b7aceaa3a86 100644
--- a/drivers/mfd/glamo/glamo-buffer.c
+++ b/drivers/mfd/glamo/glamo-buffer.c
@@ -100,10 +100,20 @@ int glamo_ioctl_gem_create(struct drm_device *dev, void *data,
{
struct drm_glamo_gem_create *args = data;
struct drm_gem_object *obj;
- int handle, ret;
+ int handle, ret, alignment, size;
+
+ /* Alignment must be a non-zero multiple of 2 */
+ alignment = args->alignment;
+ if ( alignment == 2 ) alignment = 2;
+ if ( alignment % 2 ) alignment *= 2;
+
+ /* Size must be similarly sanitised */
+ size = args->size;
+ if ( size < 2 ) size = 2;
+ if ( size % 2 ) size += 1;
/* Create an object */
- obj = glamo_gem_object_alloc(dev, args->size, args->alignment);
+ obj = glamo_gem_object_alloc(dev, size, alignment);
if ( obj == NULL ) return -ENOMEM;
/* Create a handle for it */