target/linux/brcm2708/patches-4.4/0276-drm-vc4-allocate-enough-memory-in-vc4_save_hang_stat.patch

   1 From bedbbde45f7c1fce63e5f2c4e21bc9dd4e20f3c0 Mon Sep 17 00:00:00 2001
   2 From: Dan Carpenter <dan.carpenter@oracle.com>
   3 Date: Thu, 17 Dec 2015 15:39:08 +0300
   4 Subject: [PATCH 276/304] drm/vc4: allocate enough memory in
   5  vc4_save_hang_state()
   6
   7 "state" is smaller than "kernel_state" so we end up corrupting memory.
   8
   9 Fixes: 214613656b51 ('drm/vc4: Add an interface for capturing the GPU state after a hang.')
  10 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
  11 Reviewed-by: Eric Anholt <eric@anholt.net>
  12 (cherry picked from commit 7e5082fbc00cc157e57a70cdb6b9bbb21289afb1)
  13 ---
  14  drivers/gpu/drm/vc4/vc4_gem.c | 2 +-
  15  1 file changed, 1 insertion(+), 1 deletion(-)
  16
  17 --- a/drivers/gpu/drm/vc4/vc4_gem.c
  18 +++ b/drivers/gpu/drm/vc4/vc4_gem.c
  19 @@ -159,7 +159,7 @@ vc4_save_hang_state(struct drm_device *d
  20         unsigned long irqflags;
  21         unsigned int i, unref_list_count;
  22
  23 -       kernel_state = kcalloc(1, sizeof(*state), GFP_KERNEL);
  24 +       kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL);
  25         if (!kernel_state)
  26                 return;
  27