vmwgfx: corruption in vmw_event_fence_action_create()

PATCH New Dan Carpenter 1 participant 1 message Sep 23, 2012

Subsystems (4)

DRM drivers DRM misc Kernel janitors DRM driver for VMware virtual GPU

lore

Share & tools

lore

Dan Carpenter

author

2012-09-23 16:33 UTC #0 lore raw

PATCH 1/1 vmwgfx: corruption in vmw_event_fence_action_create()

We don't allocate enough data for this struct. As soon as we start modifying event->event on the next lines, then we're going beyond the end of the memory we allocated.

Signed-off-by Dan Carpenter <[email protected]>

---
Static checker work. Not tested.

drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +1 -1

index f2fb8f1..7e07433 100644
@@ -1018,7 +1018,7 @@ int vmw_event_fence_action_create(struct drm_file *file_priv,
 	}
 
 
-	event = kzalloc(sizeof(event->event), GFP_KERNEL);
+	event = kzalloc(sizeof(*event), GFP_KERNEL);
 	if (unlikely(event = NULL)) {
 		DRM_ERROR("Failed to allocate an event.\n");
 		ret = -ENOMEM;