From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 17 Dec 2015 12:39:08 +0000 (+0300)
Subject: drm/vc4: allocate enough memory in vc4_save_hang_state()
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=7e5082fbc00cc157e57a70cdb6b9bbb21289afb1;p=openwrt%2Fstaging%2Fblogic.git

drm/vc4: allocate enough memory in vc4_save_hang_state()

"state" is smaller than "kernel_state" so we end up corrupting memory.

Fixes: 214613656b51 ('drm/vc4: Add an interface for capturing the GPU state after a hang.')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
---

diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 461a16ce2698..1928c0a454be 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -145,7 +145,7 @@ vc4_save_hang_state(struct drm_device *dev)
 	unsigned long irqflags;
 	unsigned int i, unref_list_count;
 
-	kernel_state = kcalloc(1, sizeof(*state), GFP_KERNEL);
+	kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL);
 	if (!kernel_state)
 		return;