[Nouveau] [PATCH] drm/nouveau/vm: fix memory corruption when pgt allocation fails

[Marcin Slusarz]

On Thu, Dec 20, 2012 at 11:37:09PM +0100, Marcin Slusarz wrote:
> If we return freed vm, nouveau_drm_open will happily call nouveau_cli_destroy,
> which will try to free it again.
> 
> Reported-by: Peter Hurley <peter at hurleysoftware.com>
> Signed-off-by: Marcin Slusarz <marcin.slusarz at gmail.com>
> ---

BTW, this fixes https://bugs.freedesktop.org/show_bug.cgi?id=58087

>  drivers/gpu/drm/nouveau/core/subdev/vm/base.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
> index 082c11b..77c67fc 100644
> --- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
> +++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
> @@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
>  	u64 mm_length = (offset + length) - mm_offset;
>  	int ret;
>  
> -	vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL);
> +	vm = kzalloc(sizeof(*vm), GFP_KERNEL);
>  	if (!vm)
>  		return -ENOMEM;
>  
> @@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
>  		return ret;
>  	}
>  
> +	*pvm = vm;
> +
>  	return 0;
>  }
>  
> --