[PATCH] drm/nouveau/vm: fix memory corruption when pgt allocation fails

[PATCH] drm/nouveau/vm: fix memory corruption when pgt allocation fails

[Marcin Slusarz]

If we return freed vm, nouveau_drm_open will happily call nouveau_cli_destroy,
which will try to free it again.

Reported-by: Peter Hurley <peter-WaGBZJeGNqdsbIuE7sb01tBPR1lH4CV8@public.gmane.org>
Signed-off-by: Marcin Slusarz <marcin.slusarz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
---
 drivers/gpu/drm/nouveau/core/subdev/vm/base.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
index 082c11b..77c67fc 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
@@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
 	u64 mm_length = (offset + length) - mm_offset;
 	int ret;
 
-	vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL);
+	vm = kzalloc(sizeof(*vm), GFP_KERNEL);
 	if (!vm)
 		return -ENOMEM;
 
@@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
 		return ret;
 	}
 
+	*pvm = vm;
+
 	return 0;
 }
 
-- 
1.8.0.2

Re: [PATCH] drm/nouveau/vm: fix memory corruption when pgt allocation fails

[Marcin Slusarz]

On Thu, Dec 20, 2012 at 11:37:09PM +0100, Marcin Slusarz wrote:
> If we return freed vm, nouveau_drm_open will happily call nouveau_cli_destroy,
> which will try to free it again.
> 
> Reported-by: Peter Hurley <peter-WaGBZJeGNqdsbIuE7sb01tBPR1lH4CV8@public.gmane.org>
> Signed-off-by: Marcin Slusarz <marcin.slusarz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
> ---

BTW, this fixes https://bugs.freedesktop.org/show_bug.cgi?id=58087

>  drivers/gpu/drm/nouveau/core/subdev/vm/base.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
> index 082c11b..77c67fc 100644
> --- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
> +++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
> @@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
>  	u64 mm_length = (offset + length) - mm_offset;
>  	int ret;
>  
> -	vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL);
> +	vm = kzalloc(sizeof(*vm), GFP_KERNEL);
>  	if (!vm)
>  		return -ENOMEM;
>  
> @@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
>  		return ret;
>  	}
>  
> +	*pvm = vm;
> +
>  	return 0;
>  }
>  
> --