From 3fc661a98c8046a27dcf45a63049ee6605ebd364 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= Date: Wed, 8 Jun 2016 11:59:37 +0200 Subject: brcm2708: update linux 4.4 patches to latest version MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As usual these patches were extracted from the raspberry pi repo: https://github.com/raspberrypi/linux/tree/rpi-4.4.y Also alphabetically order sound-soc kernel packages. Signed-off-by: Álvaro Fernández Rojas --- ...ocate-enough-memory-in-vc4_save_hang_stat.patch | 27 ++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 target/linux/brcm2708/patches-4.4/0275-drm-vc4-allocate-enough-memory-in-vc4_save_hang_stat.patch (limited to 'target/linux/brcm2708/patches-4.4/0275-drm-vc4-allocate-enough-memory-in-vc4_save_hang_stat.patch') diff --git a/target/linux/brcm2708/patches-4.4/0275-drm-vc4-allocate-enough-memory-in-vc4_save_hang_stat.patch b/target/linux/brcm2708/patches-4.4/0275-drm-vc4-allocate-enough-memory-in-vc4_save_hang_stat.patch new file mode 100644 index 0000000..02db6b5 --- /dev/null +++ b/target/linux/brcm2708/patches-4.4/0275-drm-vc4-allocate-enough-memory-in-vc4_save_hang_stat.patch @@ -0,0 +1,27 @@ +From c33b2893076c1ff4decffd300f84aaa2cc10d1a4 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 17 Dec 2015 15:39:08 +0300 +Subject: [PATCH 275/381] drm/vc4: allocate enough memory in + vc4_save_hang_state() + +"state" is smaller than "kernel_state" so we end up corrupting memory. + +Fixes: 214613656b51 ('drm/vc4: Add an interface for capturing the GPU state after a hang.') +Signed-off-by: Dan Carpenter +Reviewed-by: Eric Anholt +(cherry picked from commit 7e5082fbc00cc157e57a70cdb6b9bbb21289afb1) +--- + drivers/gpu/drm/vc4/vc4_gem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vc4/vc4_gem.c ++++ b/drivers/gpu/drm/vc4/vc4_gem.c +@@ -159,7 +159,7 @@ vc4_save_hang_state(struct drm_device *d + unsigned long irqflags; + unsigned int i, unref_list_count; + +- kernel_state = kcalloc(1, sizeof(*state), GFP_KERNEL); ++ kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL); + if (!kernel_state) + return; + -- cgit v1.1