diff options
author | Konsta Holtta <kholtta@nvidia.com> | 2016-12-07 06:48:59 -0500 |
---|---|---|
committer | mobile promotions <svcmobile_promotions@nvidia.com> | 2016-12-19 18:40:25 -0500 |
commit | b018428c166959c99f045a70db87a42a4e061fed (patch) | |
tree | 82437c0db54acfe07d01971ee49f199a12d0da0d /drivers/gpu | |
parent | 9da40c79fc36ea73cf682a7f4c76c8717bcf4fce (diff) |
gpu: nvgpu: Remove BUG_ON from _IOC_SIZE checks
When the user-supplied ioctl argument size is too large, just return
-EINVAL from the ioctl instead of crashing on a BUG_ON (for as, ctrl,
ctxsw, dbg and tsg nodes - channel and sched nodes are already okay).
Bug 1849661
Change-Id: I5b0d1d0c4ee47ce0136c424dda5975353f110c7e
Signed-off-by: Konsta Holtta <kholtta@nvidia.com>
Reviewed-on: http://git-master/r/1266606
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
Diffstat (limited to 'drivers/gpu')
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/as_gk20a.c | 5 | ||||
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c | 5 | ||||
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/ctxsw_trace_gk20a.c | 8 | ||||
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c | 5 | ||||
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/tsg_gk20a.c | 5 |
5 files changed, 12 insertions, 16 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/as_gk20a.c b/drivers/gpu/nvgpu/gk20a/as_gk20a.c index 6cdbe3e1..0b90090a 100644 --- a/drivers/gpu/nvgpu/gk20a/as_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/as_gk20a.c | |||
@@ -368,11 +368,10 @@ long gk20a_as_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) | |||
368 | 368 | ||
369 | if ((_IOC_TYPE(cmd) != NVGPU_AS_IOCTL_MAGIC) || | 369 | if ((_IOC_TYPE(cmd) != NVGPU_AS_IOCTL_MAGIC) || |
370 | (_IOC_NR(cmd) == 0) || | 370 | (_IOC_NR(cmd) == 0) || |
371 | (_IOC_NR(cmd) > NVGPU_AS_IOCTL_LAST)) | 371 | (_IOC_NR(cmd) > NVGPU_AS_IOCTL_LAST) || |
372 | (_IOC_SIZE(cmd) > NVGPU_AS_IOCTL_MAX_ARG_SIZE)) | ||
372 | return -EINVAL; | 373 | return -EINVAL; |
373 | 374 | ||
374 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_AS_IOCTL_MAX_ARG_SIZE); | ||
375 | |||
376 | memset(buf, 0, sizeof(buf)); | 375 | memset(buf, 0, sizeof(buf)); |
377 | if (_IOC_DIR(cmd) & _IOC_WRITE) { | 376 | if (_IOC_DIR(cmd) & _IOC_WRITE) { |
378 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) | 377 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) |
diff --git a/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c b/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c index defa4fdd..77479d99 100644 --- a/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c | |||
@@ -1316,11 +1316,10 @@ long gk20a_ctrl_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg | |||
1316 | 1316 | ||
1317 | if ((_IOC_TYPE(cmd) != NVGPU_GPU_IOCTL_MAGIC) || | 1317 | if ((_IOC_TYPE(cmd) != NVGPU_GPU_IOCTL_MAGIC) || |
1318 | (_IOC_NR(cmd) == 0) || | 1318 | (_IOC_NR(cmd) == 0) || |
1319 | (_IOC_NR(cmd) > NVGPU_GPU_IOCTL_LAST)) | 1319 | (_IOC_NR(cmd) > NVGPU_GPU_IOCTL_LAST) || |
1320 | (_IOC_SIZE(cmd) > NVGPU_GPU_IOCTL_MAX_ARG_SIZE)) | ||
1320 | return -EINVAL; | 1321 | return -EINVAL; |
1321 | 1322 | ||
1322 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_GPU_IOCTL_MAX_ARG_SIZE); | ||
1323 | |||
1324 | memset(buf, 0, sizeof(buf)); | 1323 | memset(buf, 0, sizeof(buf)); |
1325 | if (_IOC_DIR(cmd) & _IOC_WRITE) { | 1324 | if (_IOC_DIR(cmd) & _IOC_WRITE) { |
1326 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) | 1325 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) |
diff --git a/drivers/gpu/nvgpu/gk20a/ctxsw_trace_gk20a.c b/drivers/gpu/nvgpu/gk20a/ctxsw_trace_gk20a.c index 1f18d9cf..a443512c 100644 --- a/drivers/gpu/nvgpu/gk20a/ctxsw_trace_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/ctxsw_trace_gk20a.c | |||
@@ -360,12 +360,12 @@ long gk20a_ctxsw_dev_ioctl(struct file *filp, unsigned int cmd, | |||
360 | 360 | ||
361 | gk20a_dbg(gpu_dbg_fn|gpu_dbg_ctxsw, "nr=%d", _IOC_NR(cmd)); | 361 | gk20a_dbg(gpu_dbg_fn|gpu_dbg_ctxsw, "nr=%d", _IOC_NR(cmd)); |
362 | 362 | ||
363 | if ((_IOC_TYPE(cmd) != NVGPU_CTXSW_IOCTL_MAGIC) || (_IOC_NR(cmd) == 0) | 363 | if ((_IOC_TYPE(cmd) != NVGPU_CTXSW_IOCTL_MAGIC) || |
364 | || (_IOC_NR(cmd) > NVGPU_CTXSW_IOCTL_LAST)) | 364 | (_IOC_NR(cmd) == 0) || |
365 | (_IOC_NR(cmd) > NVGPU_CTXSW_IOCTL_LAST) || | ||
366 | (_IOC_SIZE(cmd) > NVGPU_CTXSW_IOCTL_MAX_ARG_SIZE)) | ||
365 | return -EINVAL; | 367 | return -EINVAL; |
366 | 368 | ||
367 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_CTXSW_IOCTL_MAX_ARG_SIZE); | ||
368 | |||
369 | memset(buf, 0, sizeof(buf)); | 369 | memset(buf, 0, sizeof(buf)); |
370 | if (_IOC_DIR(cmd) & _IOC_WRITE) { | 370 | if (_IOC_DIR(cmd) & _IOC_WRITE) { |
371 | if (copy_from_user(buf, (void __user *) arg, _IOC_SIZE(cmd))) | 371 | if (copy_from_user(buf, (void __user *) arg, _IOC_SIZE(cmd))) |
diff --git a/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c b/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c index 1a219d2e..cd3ab0c2 100644 --- a/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c | |||
@@ -880,11 +880,10 @@ long gk20a_dbg_gpu_dev_ioctl(struct file *filp, unsigned int cmd, | |||
880 | 880 | ||
881 | if ((_IOC_TYPE(cmd) != NVGPU_DBG_GPU_IOCTL_MAGIC) || | 881 | if ((_IOC_TYPE(cmd) != NVGPU_DBG_GPU_IOCTL_MAGIC) || |
882 | (_IOC_NR(cmd) == 0) || | 882 | (_IOC_NR(cmd) == 0) || |
883 | (_IOC_NR(cmd) > NVGPU_DBG_GPU_IOCTL_LAST)) | 883 | (_IOC_NR(cmd) > NVGPU_DBG_GPU_IOCTL_LAST) || |
884 | (_IOC_SIZE(cmd) > NVGPU_DBG_GPU_IOCTL_MAX_ARG_SIZE)) | ||
884 | return -EINVAL; | 885 | return -EINVAL; |
885 | 886 | ||
886 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_DBG_GPU_IOCTL_MAX_ARG_SIZE); | ||
887 | |||
888 | memset(buf, 0, sizeof(buf)); | 887 | memset(buf, 0, sizeof(buf)); |
889 | if (_IOC_DIR(cmd) & _IOC_WRITE) { | 888 | if (_IOC_DIR(cmd) & _IOC_WRITE) { |
890 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) | 889 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) |
diff --git a/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c b/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c index d98b78ea..181140d2 100644 --- a/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c | |||
@@ -608,11 +608,10 @@ long gk20a_tsg_dev_ioctl(struct file *filp, unsigned int cmd, | |||
608 | 608 | ||
609 | if ((_IOC_TYPE(cmd) != NVGPU_TSG_IOCTL_MAGIC) || | 609 | if ((_IOC_TYPE(cmd) != NVGPU_TSG_IOCTL_MAGIC) || |
610 | (_IOC_NR(cmd) == 0) || | 610 | (_IOC_NR(cmd) == 0) || |
611 | (_IOC_NR(cmd) > NVGPU_TSG_IOCTL_LAST)) | 611 | (_IOC_NR(cmd) > NVGPU_TSG_IOCTL_LAST) || |
612 | (_IOC_SIZE(cmd) > NVGPU_TSG_IOCTL_MAX_ARG_SIZE)) | ||
612 | return -EINVAL; | 613 | return -EINVAL; |
613 | 614 | ||
614 | BUG_ON(_IOC_SIZE(cmd) > NVGPU_TSG_IOCTL_MAX_ARG_SIZE); | ||
615 | |||
616 | memset(buf, 0, sizeof(buf)); | 615 | memset(buf, 0, sizeof(buf)); |
617 | if (_IOC_DIR(cmd) & _IOC_WRITE) { | 616 | if (_IOC_DIR(cmd) & _IOC_WRITE) { |
618 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) | 617 | if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) |