diff options
| author | Ben Skeggs <skeggsb@gmail.com> | 2008-02-16 17:51:44 +1100 |
|---|---|---|
| committer | Ben Skeggs <skeggsb@gmail.com> | 2008-02-16 17:51:44 +1100 |
| commit | c303cf15dcf2744028f920cf71d7e6fda709bd15 (patch) | |
| tree | d73554110d06d70982e9194417613db9927131aa /src/gallium/winsys/dri/nouveau | |
| parent | 26add9288c88108e3485ffc57c51ea9bdc0ee719 (diff) | |
nouveau: fix potential userbuf crash.
Diffstat (limited to 'src/gallium/winsys/dri/nouveau')
| -rw-r--r-- | src/gallium/winsys/dri/nouveau/nouveau_bo.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/src/gallium/winsys/dri/nouveau/nouveau_bo.c b/src/gallium/winsys/dri/nouveau/nouveau_bo.c index 6887ffa688..ad587bafdf 100644 --- a/src/gallium/winsys/dri/nouveau/nouveau_bo.c +++ b/src/gallium/winsys/dri/nouveau/nouveau_bo.c @@ -295,7 +295,8 @@ nouveau_bo_set_status(struct nouveau_bo *bo, uint32_t flags) &new, &new_map); if (ret) return ret; - } else { + } else + if (!nvbo->user) { new_sysmem = malloc(bo->size); } @@ -311,12 +312,13 @@ nouveau_bo_set_status(struct nouveau_bo *bo, uint32_t flags) if (nvbo->fence) nouveau_fence_wait(&nvbo->fence); nouveau_mem_free(bo->device, &nvbo->drm, &nvbo->map); - if (nvbo->sysmem) + if (nvbo->sysmem && !nvbo->user) free(nvbo->sysmem); nvbo->drm = new; nvbo->map = new_map; - nvbo->sysmem = new_sysmem; + if (!nvbo->user) + nvbo->sysmem = new_sysmem; bo->flags = flags; bo->offset = nvbo->drm.offset; return 0; @@ -333,7 +335,6 @@ nouveau_bo_validate_user(struct nouveau_channel *chan, struct nouveau_bo *bo, if (nvchan->user_charge + bo->size > nvdev->sa.size) return 1; - nvchan->user_charge += bo->size; if (!(flags & NOUVEAU_BO_GART)) return 1; @@ -341,6 +342,7 @@ nouveau_bo_validate_user(struct nouveau_channel *chan, struct nouveau_bo *bo, r = nouveau_bo_tmp(chan, bo->size, fence); if (!r) return 1; + nvchan->user_charge += bo->size; memcpy(nvdev->sa_map + r->start, nvbo->sysmem, bo->size); |