The patch titled
viafb: fix crash due to 4k stack overflow
has been added to the -mm tree. Its filename is
viafb-fix-crash-due-to-4k-stack-overflow.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find
out what to do about this
The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
Subject: viafb: fix crash due to 4k stack overflow
From: Bruno Prémont <bonbons@xxxxxxxxxxxxxxxxx>
The function viafb_cursor() uses 2 stack-variables of CURSOR_SIZE bits;
CURSOR_SIZE is defined as (8 * 1024). Using up twice 1k on stack is too
much for 4k-stack (though it works with 8k-stacks).
Make those two variables kzalloc'ed to preserve stack space.
Signed-off-by: Bruno Prémont <bonbons@xxxxxxxxxxxxxxxxx>
Cc: <JosephChan@xxxxxxxxxx>
Cc: Krzysztof Helt <krzysztof.h1@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
drivers/video/via/viafbdev.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff -puN drivers/video/via/viafbdev.c~viafb-fix-crash-due-to-4k-stack-overflow drivers/video/via/viafbdev.c
--- a/drivers/video/via/viafbdev.c~viafb-fix-crash-due-to-4k-stack-overflow
+++ a/drivers/video/via/viafbdev.c
@@ -1052,10 +1052,8 @@ static void viafb_imageblit(struct fb_in
static int viafb_cursor(struct fb_info *info, struct fb_cursor *cursor)
{
- u8 data[CURSOR_SIZE / 8];
- u32 data_bak[CURSOR_SIZE / 32];
u32 temp, xx, yy, bg_col = 0, fg_col = 0;
- int size, i, j = 0;
+ int i, j = 0;
static int hw_cursor;
struct viafb_par *p_viafb_par;
@@ -1178,10 +1176,15 @@ static int viafb_cursor(struct fb_info *
}
if (cursor->set & FB_CUR_SETSHAPE) {
- size =
+ u8 *data = kzalloc(CURSOR_SIZE / 8, GFP_KERNEL);
+ u32 *data_bak = kzalloc(CURSOR_SIZE / 32, GFP_KERNEL);
+ int size =
((viacursor.image.width + 7) >> 3) *
viacursor.image.height;
+ if (data == NULL || data_bak == NULL)
+ goto out;
+
if (MAX_CURS == 32) {
for (i = 0; i < (CURSOR_SIZE / 32); i++) {
data_bak[i] = 0x0;
@@ -1231,6 +1234,9 @@ static int viafb_cursor(struct fb_info *
memcpy(((struct viafb_par *)(info->par))->fbmem_virt +
((struct viafb_par *)(info->par))->cursor_start,
data_bak, CURSOR_SIZE);
+out:
+ kfree(data);
+ kfree(data_bak);
}
if (viacursor.enable)
_
Patches currently in -mm which might be from bonbons@xxxxxxxxxxxxxxxxx are
viafb-fix-crash-due-to-4k-stack-overflow.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
