tree 4a651315ab08412d05490f66033ce738a8ac16e9
parent 4f20d9ebb9c2a6b5db3d187595cbf437ee81d135
author Dan Carpenter <dan.carpenter@oracle.com> 1348418035 +0300
committer Dave Airlie <airlied@gmail.com> 1348648806 +1000

vmwgfx: corruption in vmw_event_fence_action_create()

We don't allocate enough data for this struct.  As soon as we start
modifying event->event on the next lines, then we're going beyond the
end of the memory we allocated.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@gmail.com>