gpu: nvgpu: Remove BUG_ON from _IOC_SIZE checks

When the user-supplied ioctl argument size is too large, just return
-EINVAL from the ioctl instead of crashing on a BUG_ON (for as, ctrl,
ctxsw, dbg and tsg nodes - channel and sched nodes are already okay).

Bug 1849661

Change-Id: I5b0d1d0c4ee47ce0136c424dda5975353f110c7e
Signed-off-by: Konsta Holtta <kholtta@nvidia.com>
Reviewed-on: http://git-master/r/1266606
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>

1 files changed, 2 insertions, 3 deletions

diff --git a/drivers/gpu/nvgpu/gk20a/as_gk20a.c b/drivers/gpu/nvgpu/gk20a/as_gk20a.c
index 6cdbe3e1..0b90090a 100644
--- a/drivers/gpu/nvgpu/gk20a/as_gk20a.c
+++ b/drivers/gpu/nvgpu/gk20a/as_gk20a.c
@@ -368,11 +368,10 @@ long gk20a_as_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 
         if ((_IOC_TYPE(cmd) != NVGPU_AS_IOCTL_MAGIC) ||
                 (_IOC_NR(cmd) == 0) ||
-                (_IOC_NR(cmd) > NVGPU_AS_IOCTL_LAST))
+                (_IOC_NR(cmd) > NVGPU_AS_IOCTL_LAST) ||
+                (_IOC_SIZE(cmd) > NVGPU_AS_IOCTL_MAX_ARG_SIZE))
                 return -EINVAL;
 
-        BUG_ON(_IOC_SIZE(cmd) > NVGPU_AS_IOCTL_MAX_ARG_SIZE);
-
         memset(buf, 0, sizeof(buf));
         if (_IOC_DIR(cmd) & _IOC_WRITE) {
                 if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd)))