diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-12-17 15:39:08 +0300 |
|---|---|---|
| committer | Eric Anholt <eric@anholt.net> | 2015-12-17 11:40:21 -0800 |
| commit | 7e5082fbc00cc157e57a70cdb6b9bbb21289afb1 (patch) | |
| tree | b66ee7e19607c54997f2599dc3e25863d4af7214 | |
| parent | drm/vc4: copy_to_user() returns the number of bytes remaining (diff) | |
| download | linux-7e5082fbc00cc157e57a70cdb6b9bbb21289afb1.tar.gz linux-7e5082fbc00cc157e57a70cdb6b9bbb21289afb1.zip | |
drm/vc4: allocate enough memory in vc4_save_hang_state()
"state" is smaller than "kernel_state" so we end up corrupting memory.
Fixes: 214613656b51 ('drm/vc4: Add an interface for capturing the GPU state after a hang.')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
| -rw-r--r-- | drivers/gpu/drm/vc4/vc4_gem.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c index 461a16ce2698..1928c0a454be 100644 --- a/drivers/gpu/drm/vc4/vc4_gem.c +++ b/drivers/gpu/drm/vc4/vc4_gem.c @@ -145,7 +145,7 @@ vc4_save_hang_state(struct drm_device *dev) unsigned long irqflags; unsigned int i, unref_list_count; - kernel_state = kcalloc(1, sizeof(*state), GFP_KERNEL); + kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL); if (!kernel_state) return; |