| From: Dave Airlie <airlied@redhat.com> |
| Date: Thu, 2 Feb 2012 15:25:16 +0000 |
| Subject: drm/radeon: fix use after free in ATRM bios reading code. |
| |
| commit de47a9cd62771e3e78954d855d2304fbad4c5a44 upstream. |
| |
| Fixes: |
| https://bugs.freedesktop.org/show_bug.cgi?id=45503 |
| |
| Reported-and-Debugged-by: mlambda@gmail.com |
| Signed-off-by: Dave Airlie <airlied@redhat.com> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/gpu/drm/radeon/radeon_atpx_handler.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c |
| index 13ac63b..98724fc 100644 |
| --- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c |
| +++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c |
| @@ -59,8 +59,9 @@ static int radeon_atrm_call(acpi_handle atrm_handle, uint8_t *bios, |
| |
| obj = (union acpi_object *)buffer.pointer; |
| memcpy(bios+offset, obj->buffer.pointer, obj->buffer.length); |
| + len = obj->buffer.length; |
| kfree(buffer.pointer); |
| - return obj->buffer.length; |
| + return len; |
| } |
| |
| bool radeon_atrm_supported(struct pci_dev *pdev) |
