diff options
author | Konsta Holtta <kholtta@nvidia.com> | 2016-12-07 06:48:59 -0500 |
---|---|---|
committer | mobile promotions <svcmobile_promotions@nvidia.com> | 2016-12-19 18:40:25 -0500 |
commit | b018428c166959c99f045a70db87a42a4e061fed (patch) | |
tree | 82437c0db54acfe07d01971ee49f199a12d0da0d /drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c | |
parent | 9da40c79fc36ea73cf682a7f4c76c8717bcf4fce (diff) |
gpu: nvgpu: Remove BUG_ON from _IOC_SIZE checks
When the user-supplied ioctl argument size is too large, just return
-EINVAL from the ioctl instead of crashing on a BUG_ON (for as, ctrl,
ctxsw, dbg and tsg nodes - channel and sched nodes are already okay).
Bug 1849661
Change-Id: I5b0d1d0c4ee47ce0136c424dda5975353f110c7e
Signed-off-by: Konsta Holtta <kholtta@nvidia.com>
Reviewed-on: http://git-master/r/1266606
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
Diffstat (limited to 'drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c')
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c b/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c index defa4fdd..77479d99 100644 --- a/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c | |||
@@ -1316,11 +1316,10 @@ long gk20a_ctrl_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg | |||
1316 | 1316 | ||
1317 | if ((_IOC_TYPE(cmd) != NVGPU_GPU_IOCTL_MAGIC) || | 1317 | if ((_IOC_TYPE(cmd) != NVGPU_GPU_IOCTL_MAGIC) || |
1318 | (_IOC_NR(cmd) == 0) || | 1318 | (_IOC_NR(cmd) == 0) || |
1319 | (_IOC_NR(cmd) > NVGPU_GPU_IOCTL_LAST)) | 1319 | (_IOC_NR(cmd) > NVGPU_GPU_IOCTL_LAST) || |
1320 | (_IOC_SIZE(cmd) > NVGPU_GPU_IOCTL_MAX_ARG_SIZE)) | ||
1320 | return -EINVAL; | 1321 | return -EINVAL; |
1321 | 1322 | ||
1322 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_GPU_IOCTL_MAX_ARG_SIZE); | ||
1323 | |||
1324 | memset(buf, 0, sizeof(buf)); | 1323 | memset(buf, 0, sizeof(buf)); |
1325 | if (_IOC_DIR(cmd) & _IOC_WRITE) { | 1324 | if (_IOC_DIR(cmd) & _IOC_WRITE) { |
1326 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) | 1325 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) |