This is a note to let you know that I've just added the patch titled
drm/nouveau/vm: fix memory corruption when pgt allocation fails
to the 3.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch
and it can be found in the queue-3.7 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From cfd376b6bfccf33782a0748a9c70f7f752f8b869 Mon Sep 17 00:00:00 2001
From: Marcin Slusarz <[email protected]>
Date: Mon, 10 Dec 2012 21:30:51 +0100
Subject: drm/nouveau/vm: fix memory corruption when pgt allocation fails
From: Marcin Slusarz <[email protected]>
commit cfd376b6bfccf33782a0748a9c70f7f752f8b869 upstream.
If we return freed vm, nouveau_drm_open will happily call nouveau_cli_destroy,
which will try to free it again.
Reported-by: Peter Hurley <[email protected]>
Signed-off-by: Marcin Slusarz <[email protected]>
Signed-off-by: Ben Skeggs <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/gpu/drm/nouveau/core/subdev/vm/base.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
@@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr *
u64 mm_length = (offset + length) - mm_offset;
int ret;
- vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL);
+ vm = kzalloc(sizeof(*vm), GFP_KERNEL);
if (!vm)
return -ENOMEM;
@@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr *
return ret;
}
+ *pvm = vm;
+
return 0;
}
Patches currently in stable-queue which might be from [email protected]
are
queue-3.7/drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
