3.7-stable patches

added patches:
	drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch

diff --git a/queue-3.7/drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch b/queue-3.7/drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch
new file mode 100644 (file)
index 0000000..0cc4576
--- /dev/null
+++ b/queue-3.7/drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch
@@ -0,0 +1,41 @@
+From cfd376b6bfccf33782a0748a9c70f7f752f8b869 Mon Sep 17 00:00:00 2001
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+Date: Mon, 10 Dec 2012 21:30:51 +0100
+Subject: drm/nouveau/vm: fix memory corruption when pgt allocation fails
+
+From: Marcin Slusarz <marcin.slusarz@gmail.com>
+
+commit cfd376b6bfccf33782a0748a9c70f7f752f8b869 upstream.
+
+If we return freed vm, nouveau_drm_open will happily call nouveau_cli_destroy,
+which will try to free it again.
+
+Reported-by: Peter Hurley <peter@hurleysoftware.com>
+Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/core/subdev/vm/base.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
++++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
+@@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr *
+       u64 mm_length = (offset + length) - mm_offset;
+       int ret;
+ 
+-      vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL);
++      vm = kzalloc(sizeof(*vm), GFP_KERNEL);
+       if (!vm)
+               return -ENOMEM;
+ 
+@@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr *
+               return ret;
+       }
+ 
++      *pvm = vm;
++
+       return 0;
+ }
+ 

diff --git a/queue-3.7/series b/queue-3.7/series
new file mode 100644 (file)
index 0000000..f8060d0
--- /dev/null
+++ b/queue-3.7/series
@@ -0,0 +1 @@
+drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch