From: Roel Kluin <roel.kluin@gmail.com>
Date: Mon, 3 Aug 2009 12:22:53 +0000 (+0200)
Subject: drm/ttm: Read buffer overflow
X-Git-Tag: v2.6.31-rc6~71^2
X-Git-Url: http://ftp.safe.ca/?a=commitdiff_plain;h=c96e7c7a3a79931446ecf9494a8415e4d164ebd8;hp=fa99239cb73dbf419bea9f334b85ba94ac88a532;p=safe%2Fjmp%2Flinux-2.6

drm/ttm: Read buffer overflow

Check whether index is within bounds before grabbing the element.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
---

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index aa82d53..c2b0d71 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1182,13 +1182,14 @@ static int ttm_bo_force_list_clean(struct ttm_bo_device *bdev,
 
 int ttm_bo_clean_mm(struct ttm_bo_device *bdev, unsigned mem_type)
 {
-	struct ttm_mem_type_manager *man = &bdev->man[mem_type];
+	struct ttm_mem_type_manager *man;
 	int ret = -EINVAL;
 
 	if (mem_type >= TTM_NUM_MEM_TYPES) {
 		printk(KERN_ERR TTM_PFX "Illegal memory type %d\n", mem_type);
 		return ret;
 	}
+	man = &bdev->man[mem_type];
 
 	if (!man->has_type) {
 		printk(KERN_ERR TTM_PFX "Trying to take down uninitialized "