diff options
author | Alex Waterman <alexw@nvidia.com> | 2017-08-28 13:55:26 -0400 |
---|---|---|
committer | mobile promotions <svcmobile_promotions@nvidia.com> | 2017-09-11 21:12:53 -0400 |
commit | e68391690cfcc23b77c68aec3f9605badea226ed (patch) | |
tree | ea4c2ea6ae0b0d841bbb97d83e8e19cf29fdcd49 /drivers/gpu | |
parent | 65f18d74ee8e84ef18866811472f47f86cac1030 (diff) |
gpu: nvgpu: Validate buffer_offset argument
Validate the mapping_size argument in the VM mapping IOCTL before
attempting to use the argument for anything.
Bug 1954931
Change-Id: I81b22dc566c6c6f89e5e62604ce996376b33a343
Signed-off-by: Alex Waterman <alexw@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1547046
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svccoveritychecker <svccoveritychecker@nvidia.com>
Reviewed-by: Konsta Holtta <kholtta@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
Diffstat (limited to 'drivers/gpu')
-rw-r--r-- | drivers/gpu/nvgpu/common/linux/vm.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/gpu/nvgpu/common/linux/vm.c b/drivers/gpu/nvgpu/common/linux/vm.c index f2a38f7c..58e2da13 100644 --- a/drivers/gpu/nvgpu/common/linux/vm.c +++ b/drivers/gpu/nvgpu/common/linux/vm.c | |||
@@ -266,6 +266,12 @@ u64 nvgpu_vm_map(struct vm_gk20a *vm, | |||
266 | mapping_size = mapping_size ? mapping_size : bfr.size; | 266 | mapping_size = mapping_size ? mapping_size : bfr.size; |
267 | mapping_size = ALIGN(mapping_size, SZ_4K); | 267 | mapping_size = ALIGN(mapping_size, SZ_4K); |
268 | 268 | ||
269 | if ((mapping_size > bfr.size) || | ||
270 | (buffer_offset > (bfr.size - mapping_size))) { | ||
271 | err = -EINVAL; | ||
272 | goto clean_up; | ||
273 | } | ||
274 | |||
269 | /* Check if we should use a fixed offset for mapping this buffer */ | 275 | /* Check if we should use a fixed offset for mapping this buffer */ |
270 | if (flags & NVGPU_AS_MAP_BUFFER_FLAGS_FIXED_OFFSET) { | 276 | if (flags & NVGPU_AS_MAP_BUFFER_FLAGS_FIXED_OFFSET) { |
271 | err = nvgpu_vm_area_validate_buffer(vm, offset_align, mapping_size, | 277 | err = nvgpu_vm_area_validate_buffer(vm, offset_align, mapping_size, |