drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

[pandora-kernel.git] / drivers / gpu / drm / vmwgfx / vmwgfx_ioctl.c

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index 5ff561d..bce4047 100644 (file)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -58,8 +58,14 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
        case DRM_VMW_PARAM_FIFO_HW_VERSION:
        {
                __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
-
-               param->value = ioread32(fifo_mem + SVGA_FIFO_3D_HWVERSION);
+               const struct vmw_fifo_state *fifo = &dev_priv->fifo;
+
+               param->value =
+                       ioread32(fifo_mem +
+                                ((fifo->capabilities &
+                                  SVGA_FIFO_CAP_3D_HWVERSION_REVISED) ?
+                                 SVGA_FIFO_3D_HWVERSION_REVISED :
+                                 SVGA_FIFO_3D_HWVERSION));
                break;
        }
        default:
@@ -84,7 +90,7 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
        void *bounce;
        int ret;
 
-       if (unlikely(arg->pad64 != 0)) {
+       if (unlikely(arg->pad64 != 0 || arg->max_size == 0)) {
                DRM_ERROR("Illegal GET_3D_CAP argument.\n");
                return -EINVAL;
        }
@@ -166,13 +172,7 @@ int vmw_present_ioctl(struct drm_device *dev, void *data,
                ret = -EINVAL;
                goto out_no_fb;
        }
-
        vfb = vmw_framebuffer_to_vfb(obj_to_fb(obj));
-       if (!vfb->dmabuf) {
-               DRM_ERROR("Framebuffer not dmabuf backed.\n");
-               ret = -EINVAL;
-               goto out_no_fb;
-       }
 
        ret = ttm_read_lock(&vmaster->lock, true);
        if (unlikely(ret != 0))