diff options
author | Terje Bergstrom <tbergstrom@nvidia.com> | 2014-11-25 06:54:03 -0500 |
---|---|---|
committer | Dan Willemsen <dwillemsen@nvidia.com> | 2015-03-18 15:12:25 -0400 |
commit | 383f176a9db510e51a04b2dc00fad47aa0a1ed6b (patch) | |
tree | f759d476c717a23356fb02d2b25433b795f96928 /drivers/gpu/nvgpu | |
parent | 0fd396a87db467aa1a80d833e8deaa9aeaf7cd91 (diff) |
gpu: nvgpu: Submit coverity fixes
Clear ioctl buffer and fix double free, and error case memory leak.
Bug 200059216
Change-Id: I21cc2b0f6a7e8fca09f72caf4c54d570b13f400b
Signed-off-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-on: http://git-master/r/655347
Diffstat (limited to 'drivers/gpu/nvgpu')
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/as_gk20a.c | 1 | ||||
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c | 1 | ||||
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c | 1 | ||||
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/tsg_gk20a.c | 1 | ||||
-rw-r--r-- | drivers/gpu/nvgpu/gm20b/acr_gm20b.c | 1 | ||||
-rw-r--r-- | drivers/gpu/nvgpu/vgpu/gr_vgpu.c | 1 |
6 files changed, 5 insertions, 1 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/as_gk20a.c b/drivers/gpu/nvgpu/gk20a/as_gk20a.c index 34423d21..cd5cdd48 100644 --- a/drivers/gpu/nvgpu/gk20a/as_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/as_gk20a.c | |||
@@ -265,6 +265,7 @@ long gk20a_as_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) | |||
265 | 265 | ||
266 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_AS_IOCTL_MAX_ARG_SIZE); | 266 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_AS_IOCTL_MAX_ARG_SIZE); |
267 | 267 | ||
268 | memset(buf, 0, sizeof(buf)); | ||
268 | if (_IOC_DIR(cmd) & _IOC_WRITE) { | 269 | if (_IOC_DIR(cmd) & _IOC_WRITE) { |
269 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) | 270 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) |
270 | return -EFAULT; | 271 | return -EFAULT; |
diff --git a/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c b/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c index 34351f93..4e85abc8 100644 --- a/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c | |||
@@ -268,6 +268,7 @@ long gk20a_ctrl_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg | |||
268 | 268 | ||
269 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_GPU_IOCTL_MAX_ARG_SIZE); | 269 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_GPU_IOCTL_MAX_ARG_SIZE); |
270 | 270 | ||
271 | memset(buf, 0, sizeof(buf)); | ||
271 | if (_IOC_DIR(cmd) & _IOC_WRITE) { | 272 | if (_IOC_DIR(cmd) & _IOC_WRITE) { |
272 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) | 273 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) |
273 | return -EFAULT; | 274 | return -EFAULT; |
diff --git a/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c b/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c index 72998280..35a43130 100644 --- a/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c | |||
@@ -388,6 +388,7 @@ long gk20a_dbg_gpu_dev_ioctl(struct file *filp, unsigned int cmd, | |||
388 | 388 | ||
389 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_DBG_GPU_IOCTL_MAX_ARG_SIZE); | 389 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_DBG_GPU_IOCTL_MAX_ARG_SIZE); |
390 | 390 | ||
391 | memset(buf, 0, sizeof(buf)); | ||
391 | if (_IOC_DIR(cmd) & _IOC_WRITE) { | 392 | if (_IOC_DIR(cmd) & _IOC_WRITE) { |
392 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) | 393 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) |
393 | return -EFAULT; | 394 | return -EFAULT; |
diff --git a/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c b/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c index 3342e3b9..37a326d2 100644 --- a/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c | |||
@@ -234,6 +234,7 @@ long gk20a_tsg_dev_ioctl(struct file *filp, unsigned int cmd, | |||
234 | 234 | ||
235 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_TSG_IOCTL_MAX_ARG_SIZE); | 235 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_TSG_IOCTL_MAX_ARG_SIZE); |
236 | 236 | ||
237 | memset(buf, 0, sizeof(buf)); | ||
237 | if (_IOC_DIR(cmd) & _IOC_WRITE) { | 238 | if (_IOC_DIR(cmd) & _IOC_WRITE) { |
238 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) | 239 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) |
239 | return -EFAULT; | 240 | return -EFAULT; |
diff --git a/drivers/gpu/nvgpu/gm20b/acr_gm20b.c b/drivers/gpu/nvgpu/gm20b/acr_gm20b.c index 7c6b734b..2fb3bf9d 100644 --- a/drivers/gpu/nvgpu/gm20b/acr_gm20b.c +++ b/drivers/gpu/nvgpu/gm20b/acr_gm20b.c | |||
@@ -163,7 +163,6 @@ int fecs_ucode_details(struct gk20a *g, struct flcn_ucode_img *p_img) | |||
163 | 163 | ||
164 | p_img->desc = kzalloc(sizeof(struct pmu_ucode_desc), GFP_KERNEL); | 164 | p_img->desc = kzalloc(sizeof(struct pmu_ucode_desc), GFP_KERNEL); |
165 | if (p_img->desc == NULL) { | 165 | if (p_img->desc == NULL) { |
166 | kfree(lsf_desc); | ||
167 | err = -ENOMEM; | 166 | err = -ENOMEM; |
168 | goto free_lsf_desc; | 167 | goto free_lsf_desc; |
169 | } | 168 | } |
diff --git a/drivers/gpu/nvgpu/vgpu/gr_vgpu.c b/drivers/gpu/nvgpu/vgpu/gr_vgpu.c index 46b48b33..b1a8027e 100644 --- a/drivers/gpu/nvgpu/vgpu/gr_vgpu.c +++ b/drivers/gpu/nvgpu/vgpu/gr_vgpu.c | |||
@@ -273,6 +273,7 @@ static int vgpu_gr_alloc_channel_gr_ctx(struct gk20a *g, | |||
273 | err = vgpu_comm_sendrecv(&msg, sizeof(msg), sizeof(msg)); | 273 | err = vgpu_comm_sendrecv(&msg, sizeof(msg), sizeof(msg)); |
274 | 274 | ||
275 | if (err || msg.ret) { | 275 | if (err || msg.ret) { |
276 | kfree(gr_ctx); | ||
276 | gk20a_vm_free_va(ch_vm, gr_ctx->gpu_va, gr_ctx->size, 0); | 277 | gk20a_vm_free_va(ch_vm, gr_ctx->gpu_va, gr_ctx->size, 0); |
277 | err = -ENOMEM; | 278 | err = -ENOMEM; |
278 | } else | 279 | } else |