diff options
Diffstat (limited to 'drivers/gpu/nvgpu')
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/mm_gk20a.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c index e8e80a99..dd23023b 100644 --- a/drivers/gpu/nvgpu/gk20a/mm_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/mm_gk20a.c | |||
@@ -1080,6 +1080,13 @@ static int validate_fixed_buffer(struct vm_gk20a *vm, | |||
1080 | struct device *dev = dev_from_vm(vm); | 1080 | struct device *dev = dev_from_vm(vm); |
1081 | struct vm_reserved_va_node *va_node; | 1081 | struct vm_reserved_va_node *va_node; |
1082 | struct mapped_buffer_node *buffer; | 1082 | struct mapped_buffer_node *buffer; |
1083 | u64 map_end = map_offset + map_size; | ||
1084 | |||
1085 | /* can wrap around with insane map_size; zero is disallowed too */ | ||
1086 | if (map_end <= map_offset) { | ||
1087 | gk20a_warn(dev, "fixed offset mapping with invalid map_size"); | ||
1088 | return -EINVAL; | ||
1089 | } | ||
1083 | 1090 | ||
1084 | if (map_offset & gmmu_page_offset_masks[bfr->pgsz_idx]) { | 1091 | if (map_offset & gmmu_page_offset_masks[bfr->pgsz_idx]) { |
1085 | gk20a_err(dev, "map offset must be buffer page size aligned 0x%llx", | 1092 | gk20a_err(dev, "map offset must be buffer page size aligned 0x%llx", |
@@ -1094,6 +1101,12 @@ static int validate_fixed_buffer(struct vm_gk20a *vm, | |||
1094 | return -EINVAL; | 1101 | return -EINVAL; |
1095 | } | 1102 | } |
1096 | 1103 | ||
1104 | /* mapped area should fit inside va */ | ||
1105 | if (map_end > va_node->vaddr_start + va_node->size) { | ||
1106 | gk20a_warn(dev, "fixed offset mapping size overflows va node"); | ||
1107 | return -EINVAL; | ||
1108 | } | ||
1109 | |||
1097 | /* check that this mappings does not collide with existing | 1110 | /* check that this mappings does not collide with existing |
1098 | * mappings by checking the overlapping area between the current | 1111 | * mappings by checking the overlapping area between the current |
1099 | * buffer and all other mapped buffers */ | 1112 | * buffer and all other mapped buffers */ |