dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

drm/nouveau/vm: fix memory corruption when pgt allocation fails 

If we return freed vm, nouveau_drm_open will happily call nouveau_cli_destroy,
which will try to free it again.

Reported-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This commit is contained in:
Marcin Slusarz 2012-12-10 21:30:51 +01:00 committed by Ben Skeggs
parent 4c4101d29f
commit cfd376b6bf
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/drm/nouveau/core/subdev/vm/base.c
View File

@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
u64 mm_length = (offset + length) - mm_offset;
int ret;
vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL);
vm = kzalloc(sizeof(*vm), GFP_KERNEL);
if (!vm)
return -ENOMEM;
@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
return ret;
}
*pvm = vm;
return 0;
}