diff options
| author | Marcin Slusarz <marcin.slusarz@gmail.com> | 2012-12-10 21:30:51 +0100 |
|---|---|---|
| committer | Ben Skeggs <bskeggs@redhat.com> | 2013-01-13 18:07:40 +1000 |
| commit | cfd376b6bfccf33782a0748a9c70f7f752f8b869 (patch) | |
| tree | 71cf4e45fd5e0d57ffe3d0c72e95336989b2c3c5 /drivers | |
| parent | 4c4101d29fb6c63f78791d02c437702b11e1d4f0 (diff) | |
drm/nouveau/vm: fix memory corruption when pgt allocation fails
If we return freed vm, nouveau_drm_open will happily call nouveau_cli_destroy,
which will try to free it again.
Reported-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/gpu/drm/nouveau/core/subdev/vm/base.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c index 082c11b75ac..77c67fc970e 100644 --- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c +++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c @@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length, u64 mm_length = (offset + length) - mm_offset; int ret; - vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL); + vm = kzalloc(sizeof(*vm), GFP_KERNEL); if (!vm) return -ENOMEM; @@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length, return ret; } + *pvm = vm; + return 0; } |