diff options
author | Peter Daifuku <pdaifuku@nvidia.com> | 2017-05-17 20:40:47 -0400 |
---|---|---|
committer | mobile promotions <svcmobile_promotions@nvidia.com> | 2017-07-27 15:24:19 -0400 |
commit | 1552e3fb09741309ea2d5cc4433e247bae7265e1 (patch) | |
tree | 3233dce8823514d9927806e10f9852e65c64ded2 /drivers | |
parent | ea180847e146450b53de5c41c3f43b19391b4c5d (diff) |
gpu: nvgpu: check for buffer overflow when mapping
In gk20a_vm_map_buffer, return an error if the buffer size is
less than offset + mapping size.
Bug 1793926
Change-Id: I2209de6a6f2e2b3bd8830659208d6f88bbedc00d
Signed-off-by: Peter Daifuku <pdaifuku@nvidia.com>
Reviewed-on: http://git-master/r/1484442
(cherry picked from commit 7e6a80cb4684a3e2534bc68cba4c1612a845a8f3)
Reviewed-on: http://git-master/r/1488138
(cherry picked from commit 3331f6e47f1d214ad6aaf08ae3e7d241e31d6638)
Reviewed-on: https://git-master.nvidia.com/r/1501677
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/mm_gk20a.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c index fab80e69..c4dfb1b3 100644 --- a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c | |||
@@ -1997,6 +1997,13 @@ int nvgpu_vm_map_buffer(struct vm_gk20a *vm, | |||
1997 | return PTR_ERR(dmabuf); | 1997 | return PTR_ERR(dmabuf); |
1998 | } | 1998 | } |
1999 | 1999 | ||
2000 | if (dmabuf->size < (buffer_offset + mapping_size)) { | ||
2001 | nvgpu_err(gk20a_from_vm(vm), | ||
2002 | "buf size %llx < (offset(%llx) + map_size(%llx))\n", | ||
2003 | (u64)dmabuf->size, buffer_offset, mapping_size); | ||
2004 | return -EINVAL; | ||
2005 | } | ||
2006 | |||
2000 | err = gk20a_dmabuf_alloc_drvdata(dmabuf, dev_from_vm(vm)); | 2007 | err = gk20a_dmabuf_alloc_drvdata(dmabuf, dev_from_vm(vm)); |
2001 | if (err) { | 2008 | if (err) { |
2002 | dma_buf_put(dmabuf); | 2009 | dma_buf_put(dmabuf); |