target/linux/brcm2708/patches-4.4/0272-drm-vc4-allocate-enough-memory-in-vc4_save_hang_stat.patch

   1 From 6d29873e5a006db5b342630976b5527c8049acd2 Mon Sep 17 00:00:00 2001
   2 From: Dan Carpenter <dan.carpenter@oracle.com>
   3 Date: Thu, 17 Dec 2015 15:39:08 +0300
   4 Subject: [PATCH] drm/vc4: allocate enough memory in vc4_save_hang_state()
   5
   6 "state" is smaller than "kernel_state" so we end up corrupting memory.
   7
   8 Fixes: 214613656b51 ('drm/vc4: Add an interface for capturing the GPU state after a hang.')
   9 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
  10 Reviewed-by: Eric Anholt <eric@anholt.net>
  11 (cherry picked from commit 7e5082fbc00cc157e57a70cdb6b9bbb21289afb1)
  12 ---
  13  drivers/gpu/drm/vc4/vc4_gem.c | 2 +-
  14  1 file changed, 1 insertion(+), 1 deletion(-)
  15
  16 --- a/drivers/gpu/drm/vc4/vc4_gem.c
  17 +++ b/drivers/gpu/drm/vc4/vc4_gem.c
  18 @@ -159,7 +159,7 @@ vc4_save_hang_state(struct drm_device *d
  19         unsigned long irqflags;
  20         unsigned int i, unref_list_count;
  21
  22 -       kernel_state = kcalloc(1, sizeof(*state), GFP_KERNEL);
  23 +       kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL);
  24         if (!kernel_state)
  25                 return;
  26