The patch titled viafb: fix crash due to 4k stack overflow has been removed from the -mm tree. Its filename was viafb-fix-crash-due-to-4k-stack-overflow.patch This patch was dropped because an updated version will be merged The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: viafb: fix crash due to 4k stack overflow From: Bruno Prémont <bonbons@xxxxxxxxxxxxxxxxx> The function viafb_cursor() uses 2 stack-variables of CURSOR_SIZE bits; CURSOR_SIZE is defined as (8 * 1024). Using up twice 1k on stack is too much for 4k-stack (though it works with 8k-stacks). Make those two variables kzalloc'ed to preserve stack space. Signed-off-by: Bruno Prémont <bonbons@xxxxxxxxxxxxxxxxx> Cc: <JosephChan@xxxxxxxxxx> Cc: Krzysztof Helt <krzysztof.h1@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/video/via/viafbdev.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff -puN drivers/video/via/viafbdev.c~viafb-fix-crash-due-to-4k-stack-overflow drivers/video/via/viafbdev.c --- a/drivers/video/via/viafbdev.c~viafb-fix-crash-due-to-4k-stack-overflow +++ a/drivers/video/via/viafbdev.c @@ -1052,10 +1052,8 @@ static void viafb_imageblit(struct fb_in static int viafb_cursor(struct fb_info *info, struct fb_cursor *cursor) { - u8 data[CURSOR_SIZE / 8]; - u32 data_bak[CURSOR_SIZE / 32]; u32 temp, xx, yy, bg_col = 0, fg_col = 0; - int size, i, j = 0; + int i, j = 0; static int hw_cursor; struct viafb_par *p_viafb_par; @@ -1178,10 +1176,15 @@ static int viafb_cursor(struct fb_info * } if (cursor->set & FB_CUR_SETSHAPE) { - size = + u8 *data = kzalloc(CURSOR_SIZE / 8, GFP_ATOMIC); + u32 *data_bak = kzalloc(CURSOR_SIZE / 32, GFP_ATOMIC); + int size = ((viacursor.image.width + 7) >> 3) * viacursor.image.height; + if (data == NULL || data_bak == NULL) + goto out; + if (MAX_CURS == 32) { for (i = 0; i < (CURSOR_SIZE / 32); i++) { data_bak[i] = 0x0; @@ -1231,6 +1234,9 @@ static int viafb_cursor(struct fb_info * memcpy(((struct viafb_par *)(info->par))->fbmem_virt + ((struct viafb_par *)(info->par))->cursor_start, data_bak, CURSOR_SIZE); +out: + kfree(data); + kfree(data_bak); } if (viacursor.enable) _ Patches currently in -mm which might be from bonbons@xxxxxxxxxxxxxxxxx are viafb-fix-crash-due-to-4k-stack-overflow.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html