From: Greg Kroah-Hartman Date: Thu, 21 Feb 2013 22:09:49 +0000 (-0800) Subject: 3.7-stable patches X-Git-Tag: v3.7.10~61 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5d9d1744d8d06fa440c46495e9c8768e5d816aef;p=thirdparty%2Fkernel%2Fstable-queue.git 3.7-stable patches added patches: drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch --- diff --git a/queue-3.7/drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch b/queue-3.7/drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch new file mode 100644 index 00000000000..0cc4576d714 --- /dev/null +++ b/queue-3.7/drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch @@ -0,0 +1,41 @@ +From cfd376b6bfccf33782a0748a9c70f7f752f8b869 Mon Sep 17 00:00:00 2001 +From: Marcin Slusarz +Date: Mon, 10 Dec 2012 21:30:51 +0100 +Subject: drm/nouveau/vm: fix memory corruption when pgt allocation fails + +From: Marcin Slusarz + +commit cfd376b6bfccf33782a0748a9c70f7f752f8b869 upstream. + +If we return freed vm, nouveau_drm_open will happily call nouveau_cli_destroy, +which will try to free it again. + +Reported-by: Peter Hurley +Signed-off-by: Marcin Slusarz +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/core/subdev/vm/base.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c ++++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c +@@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr * + u64 mm_length = (offset + length) - mm_offset; + int ret; + +- vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL); ++ vm = kzalloc(sizeof(*vm), GFP_KERNEL); + if (!vm) + return -ENOMEM; + +@@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr * + return ret; + } + ++ *pvm = vm; ++ + return 0; + } + diff --git a/queue-3.7/series b/queue-3.7/series new file mode 100644 index 00000000000..f8060d0ffc4 --- /dev/null +++ b/queue-3.7/series @@ -0,0 +1 @@ +drm-nouveau-vm-fix-memory-corruption-when-pgt-allocation-fails.patch