diff options
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/channel_gk20a.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c index 1f63bbd8..94d12a3d 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c | |||
@@ -712,10 +712,12 @@ static int gk20a_channel_set_wdt_status(struct channel_gk20a *ch, | |||
712 | } | 712 | } |
713 | 713 | ||
714 | static int gk20a_init_error_notifier(struct channel_gk20a *ch, | 714 | static int gk20a_init_error_notifier(struct channel_gk20a *ch, |
715 | struct nvgpu_set_error_notifier *args) { | 715 | struct nvgpu_set_error_notifier *args) |
716 | void *va; | 716 | { |
717 | 717 | struct device *dev = dev_from_gk20a(ch->g); | |
718 | struct dma_buf *dmabuf; | 718 | struct dma_buf *dmabuf; |
719 | void *va; | ||
720 | u64 end = args->offset + sizeof(struct nvgpu_notification); | ||
719 | 721 | ||
720 | if (!args->mem) { | 722 | if (!args->mem) { |
721 | pr_err("gk20a_init_error_notifier: invalid memory handle\n"); | 723 | pr_err("gk20a_init_error_notifier: invalid memory handle\n"); |
@@ -731,6 +733,13 @@ static int gk20a_init_error_notifier(struct channel_gk20a *ch, | |||
731 | pr_err("Invalid handle: %d\n", args->mem); | 733 | pr_err("Invalid handle: %d\n", args->mem); |
732 | return -EINVAL; | 734 | return -EINVAL; |
733 | } | 735 | } |
736 | |||
737 | if (end > dmabuf->size || end < sizeof(struct nvgpu_notification)) { | ||
738 | dma_buf_put(dmabuf); | ||
739 | gk20a_err(dev, "gk20a_init_error_notifier: invalid offset\n"); | ||
740 | return -EINVAL; | ||
741 | } | ||
742 | |||
734 | /* map handle */ | 743 | /* map handle */ |
735 | va = dma_buf_vmap(dmabuf); | 744 | va = dma_buf_vmap(dmabuf); |
736 | if (!va) { | 745 | if (!va) { |