From ad24c028dba639cebefc3326f925e62c3724a59e Mon Sep 17 00:00:00 2001 From: Terje Bergstrom Date: Tue, 26 Apr 2016 13:37:45 -0700 Subject: gpu: nvgpu: Validate regops num_ops argument Check that num_ops is not too big. We have a hard limit of 1 page allocated for the operations. Bug 200192125 Change-Id: I724039c9dd6e0e93d9df0f5b3a797158fdb5e687 Signed-off-by: Terje Bergstrom Reviewed-on: http://git-master/r/1132965 GVS: Gerrit_Virtual_Submit --- drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/gpu') diff --git a/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c b/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c index 520a2ffd..6b9238e9 100644 --- a/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c @@ -975,6 +975,9 @@ static int nvgpu_ioctl_channel_reg_ops(struct dbg_session_gk20a *dbg_s, struct channel_gk20a *ch; u64 ops_size = sizeof(ops[0]) * args->num_ops; + if (args->num_ops > SZ_4K / sizeof(ops[0])) + return -EINVAL; + gk20a_dbg_fn("%d ops, total size %llu", args->num_ops, ops_size); if (!dbg_s->ops) { -- cgit v1.2.2