2 files changed, 35 insertions, 12 deletions

diff --git a/drivers/char/drm/drm_drawable.c b/drivers/char/drm/drm_drawable.c
index 5580c5731eb..ce7a027b0ad 100644
--- a/drivers/char/drm/drm_drawable.c
+++ b/drivers/char/drm/drm_drawable.c
@@ -92,13 +92,13 @@ done:
 		bitfield[i] = 0;
 	}
 
-	draw.handle = i * 8 * sizeof(*bitfield) + j;
+	draw.handle = i * 8 * sizeof(*bitfield) + j + 1;
 	DRM_DEBUG("%d\n", draw.handle);
 
 	spin_lock_irqsave(&dev->drw_lock, irqflags);
 
 	bitfield[i] |= 1 << j;
-	info[draw.handle] = NULL;
+	info[draw.handle - 1] = NULL;
 
 	if (bitfield != dev->drw_bitfield) {
 		memcpy(bitfield, dev->drw_bitfield, dev->drw_bitfield_length *
@@ -132,7 +132,7 @@ int drm_rmdraw(DRM_IOCTL_ARGS)
 {
 	DRM_DEVICE;
 	drm_draw_t draw;
-	unsigned int idx, shift;
+ 	unsigned int id, idx, shift;
 	unsigned long irqflags;
 	u32 *bitfield = dev->drw_bitfield;
 	unsigned int bitfield_length = dev->drw_bitfield_length;
@@ -142,10 +142,11 @@ int drm_rmdraw(DRM_IOCTL_ARGS)
 	DRM_COPY_FROM_USER_IOCTL(draw, (drm_draw_t __user *) data,
 				 sizeof(draw));
 
-	idx = draw.handle / (8 * sizeof(*bitfield));
-	shift = draw.handle % (8 * sizeof(*bitfield));
+	id = draw.handle - 1;
+	idx = id / (8 * sizeof(*bitfield));
+	shift = id % (8 * sizeof(*bitfield));
 
-	if (idx >= bitfield_length ||
+	if (idx < 0 || idx >= bitfield_length ||
 	    !(bitfield[idx] & (1 << shift))) {
 		DRM_DEBUG("No such drawable %d\n", draw.handle);
 		return 0;
@@ -157,6 +158,12 @@ int drm_rmdraw(DRM_IOCTL_ARGS)
 
 	spin_unlock_irqrestore(&dev->drw_lock, irqflags);
 
+	if (info[id]) {
+		drm_free(info[id]->rects, info[id]->num_rects *
+			 sizeof(drm_clip_rect_t), DRM_MEM_BUFS);
+		drm_free(info[id], sizeof(**info), DRM_MEM_BUFS);
+	}
+
 	/* Can we shrink the arrays? */
 	if (idx == bitfield_length - 1) {
 		while (idx >= 0 && !bitfield[idx])
@@ -164,7 +171,7 @@ int drm_rmdraw(DRM_IOCTL_ARGS)
 
 		bitfield_length = idx + 1;
 
-		if (idx != draw.handle / (8 * sizeof(*bitfield)))
+		if (idx != id / (8 * sizeof(*bitfield)))
 			bitfield = drm_alloc(bitfield_length *
 					     sizeof(*bitfield), DRM_MEM_BUFS);
 
@@ -222,11 +229,12 @@ int drm_update_drawable_info(DRM_IOCTL_ARGS) {
 	DRM_COPY_FROM_USER_IOCTL(update, (drm_update_draw_t __user *) data,
 				 sizeof(update));
 
-	id = update.handle;
+	id = update.handle - 1;
 	idx = id / (8 * sizeof(*bitfield));
 	shift = id % (8 * sizeof(*bitfield));
 
-	if (idx >= bitfield_length || !(bitfield[idx] & (1 << shift))) {
+	if (idx < 0 || idx >= bitfield_length ||
+	    !(bitfield[idx] & (1 << shift))) {
 		DRM_ERROR("No such drawable %d\n", update.handle);
 		return DRM_ERR(EINVAL);
 	}
@@ -304,10 +312,13 @@ error:
  */
 drm_drawable_info_t *drm_get_drawable_info(drm_device_t *dev, drm_drawable_t id) {
 	u32 *bitfield = dev->drw_bitfield;
-	unsigned int idx = id / (8 * sizeof(*bitfield));
-	unsigned int shift = id % (8 * sizeof(*bitfield));
+	unsigned int idx, shift;
+
+	id--;
+	idx = id / (8 * sizeof(*bitfield));
+	shift = id % (8 * sizeof(*bitfield));
 
-	if (idx >= dev->drw_bitfield_length ||
+	if (idx < 0 || idx >= dev->drw_bitfield_length ||
 	    !(bitfield[idx] & (1 << shift))) {
 		DRM_DEBUG("No such drawable %d\n", id);
 		return NULL;
diff --git a/drivers/char/drm/drm_drv.c b/drivers/char/drm/drm_drv.c
index 59de4a01515..a70af0de445 100644
--- a/drivers/char/drm/drm_drv.c
+++ b/drivers/char/drm/drm_drv.c
@@ -153,6 +153,18 @@ int drm_lastclose(drm_device_t * dev)
 	if (dev->irq_enabled)
 		drm_irq_uninstall(dev);
 
+	/* Free drawable information memory */
+	for (i = 0; i < dev->drw_bitfield_length / sizeof(*dev->drw_bitfield);
+	     i++) {
+		drm_drawable_info_t *info = drm_get_drawable_info(dev, i);
+
+		if (info) {
+			drm_free(info->rects, info->num_rects *
+				 sizeof(drm_clip_rect_t), DRM_MEM_BUFS);
+			drm_free(info, sizeof(*info), DRM_MEM_BUFS);
+		}
+	}
+
 	mutex_lock(&dev->struct_mutex);
 	del_timer(&dev->timer);