[Intel-gfx] [PATCH] i915: Fix NULL pointer dereference in vblank tasklet if a drawable has no rects.

[Eric Anholt]

This could occur if you dragged a window over a window queued for swapping,
and the server updated its cliprects to 0 before the swap occurred.

Signed-off-by: Eric Anholt <eric at anholt.net>
---
 drivers/gpu/drm/i915/i915_irq.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 8332c12..6d0ae92 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -192,7 +192,8 @@ static void i915_vblank_tasklet(struct drm_device *dev)
 			struct drm_drawable_info *drw_cmp =
 				drm_get_drawable_info(dev, swap_cmp->drw_id);
 
-			if (drw_cmp &&
+			if (drw_cmp && drw_cmp->num_rects != 0 &&
+			    drw->num_rects != 0 &&
 			    drw_cmp->rects[0].y1 > drw->rects[0].y1) {
 				list_add_tail(list, hit);
 				break;
-- 
1.5.6.5