diff options
| author | Marcin Slusarz <marcin.slusarz@gmail.com> | 2012-12-10 21:30:51 +0100 |
|---|---|---|
| committer | Ben Skeggs <bskeggs@redhat.com> | 2013-01-13 17:44:18 +1000 |
| commit | ced470f9c5d857c95c8b4f55443884ab3c1b4279 (patch) | |
| tree | 65a275bc2ddfea3a3cd6d6dcfca523b2c29f2562 /nvkm/subdev/vm/base.c | |
| parent | a7ab423379013d965668eecd2dc8449c871db6d3 (diff) | |
| download | nouveau-ced470f9c5d857c95c8b4f55443884ab3c1b4279.tar.gz | |
vm: fix memory corruption when pgt allocation fails
If we return freed vm, nouveau_drm_open will happily call nouveau_cli_destroy,
which will try to free it again.
Reported-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Diffstat (limited to 'nvkm/subdev/vm/base.c')
| -rw-r--r-- | nvkm/subdev/vm/base.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/nvkm/subdev/vm/base.c b/nvkm/subdev/vm/base.c index 082c11b75..77c67fc97 100644 --- a/nvkm/subdev/vm/base.c +++ b/nvkm/subdev/vm/base.c @@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length, u64 mm_length = (offset + length) - mm_offset; int ret; - vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL); + vm = kzalloc(sizeof(*vm), GFP_KERNEL); if (!vm) return -ENOMEM; @@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length, return ret; } + *pvm = vm; + return 0; } |