Messages in this thread Patch in this message | | | Date | Wed, 01 Feb 2012 12:56:18 -0800 | From | Greg KH <> | Subject | [38/65] vmwgfx: Fix assignment in vmw_framebuffer_create_handle |
| |
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Mallon <rmallon@gmail.com>
commit bf9c05d5b6d19b3e4c9fe21047694e94f48db89b upstream.
The assignment of handle in vmw_framebuffer_create_handle doesn't actually do anything useful and is incorrectly assigning an integer value to a pointer argument. It appears that this is a typo and should be dereferencing handle rather than assigning to it directly. This fixes a bug where an undefined handle value is potentially returned to user-space.
Signed-off-by: Ryan Mallon <rmallon@gmail.com> Reviewed-by: Jakob Bornecrantz<jakob@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
--- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c @@ -313,7 +313,7 @@ int vmw_framebuffer_create_handle(struct unsigned int *handle) { if (handle) - handle = 0; + *handle = 0; return 0; }
| |