drm: Avoid oops in GEM execbuffers with bad arguments.

Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 5fe50343de11910ba30f64477c52ac31710c0b63..29d9d21e9413f65cf11ae88ecf618777046b1b8f 100644 (file)
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1763,6 +1763,10 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
                  (int) args->buffers_ptr, args->buffer_count, args->batch_len);
 #endif
 
+       if (args->buffer_count < 1) {
+               DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
+               return -EINVAL;
+       }
        /* Copy in the exec list from userland */
        exec_list = drm_calloc(sizeof(*exec_list), args->buffer_count,
                               DRM_MEM_DRIVER);