From f5fe93456f6e47cf0fea0f4c5af8f797e51498c0 Mon Sep 17 00:00:00 2001 From: Deepak Nibade Date: Tue, 1 Apr 2014 12:14:50 +0530 Subject: gpu: nvgpu: gk20a: add syncpt id checks add valid syncpt id checks when syncpt id is extracted from fence fd Bug 1448825 Change-Id: I0f1722aad60e7644b8f490f24cf18a3b80f8583c Signed-off-by: Deepak Nibade Reviewed-on: http://git-master/r/390572 Reviewed-by: Terje Bergstrom --- drivers/gpu/nvgpu/gk20a/channel_sync_gk20a.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'drivers/gpu/nvgpu') diff --git a/drivers/gpu/nvgpu/gk20a/channel_sync_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_sync_gk20a.c index 291036db..851ae18b 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_sync_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_sync_gk20a.c @@ -119,6 +119,16 @@ int gk20a_channel_syncpt_wait_fd(struct gk20a_channel_sync *s, int fd, if (!sync_fence) return -EINVAL; + /* validate syncpt ids */ + list_for_each_entry(pt, &sync_fence->pt_list_head, pt_list) { + u32 wait_id = nvhost_sync_pt_id(pt); + if (!wait_id || + wait_id >= nvhost_syncpt_nb_pts_ext(sp->host1x_pdev)) { + sync_fence_put(sync_fence); + return -EINVAL; + } + } + num_wait_cmds = nvhost_sync_num_pts(sync_fence); gk20a_channel_alloc_priv_cmdbuf(c, 4 * num_wait_cmds, &wait_cmd); if (wait_cmd == NULL) { -- cgit v1.2.2