From 383f176a9db510e51a04b2dc00fad47aa0a1ed6b Mon Sep 17 00:00:00 2001 From: Terje Bergstrom Date: Tue, 25 Nov 2014 13:54:03 +0200 Subject: gpu: nvgpu: Submit coverity fixes Clear ioctl buffer and fix double free, and error case memory leak. Bug 200059216 Change-Id: I21cc2b0f6a7e8fca09f72caf4c54d570b13f400b Signed-off-by: Terje Bergstrom Reviewed-on: http://git-master/r/655347 --- drivers/gpu/nvgpu/gk20a/as_gk20a.c | 1 + drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c | 1 + drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c | 1 + drivers/gpu/nvgpu/gk20a/tsg_gk20a.c | 1 + drivers/gpu/nvgpu/gm20b/acr_gm20b.c | 1 - drivers/gpu/nvgpu/vgpu/gr_vgpu.c | 1 + 6 files changed, 5 insertions(+), 1 deletion(-) (limited to 'drivers') diff --git a/drivers/gpu/nvgpu/gk20a/as_gk20a.c b/drivers/gpu/nvgpu/gk20a/as_gk20a.c index 34423d21..cd5cdd48 100644 --- a/drivers/gpu/nvgpu/gk20a/as_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/as_gk20a.c @@ -265,6 +265,7 @@ long gk20a_as_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) BUG_ON(_IOC_SIZE(cmd) > NVGPU_AS_IOCTL_MAX_ARG_SIZE); + memset(buf, 0, sizeof(buf)); if (_IOC_DIR(cmd) & _IOC_WRITE) { if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) return -EFAULT; diff --git a/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c b/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c index 34351f93..4e85abc8 100644 --- a/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c @@ -268,6 +268,7 @@ long gk20a_ctrl_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg BUG_ON(_IOC_SIZE(cmd) > NVGPU_GPU_IOCTL_MAX_ARG_SIZE); + memset(buf, 0, sizeof(buf)); if (_IOC_DIR(cmd) & _IOC_WRITE) { if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) return -EFAULT; diff --git a/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c b/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c index 72998280..35a43130 100644 --- a/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/dbg_gpu_gk20a.c @@ -388,6 +388,7 @@ long gk20a_dbg_gpu_dev_ioctl(struct file *filp, unsigned int cmd, BUG_ON(_IOC_SIZE(cmd) > NVGPU_DBG_GPU_IOCTL_MAX_ARG_SIZE); + memset(buf, 0, sizeof(buf)); if (_IOC_DIR(cmd) & _IOC_WRITE) { if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) return -EFAULT; diff --git a/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c b/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c index 3342e3b9..37a326d2 100644 --- a/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/tsg_gk20a.c @@ -234,6 +234,7 @@ long gk20a_tsg_dev_ioctl(struct file *filp, unsigned int cmd, BUG_ON(_IOC_SIZE(cmd) > NVGPU_TSG_IOCTL_MAX_ARG_SIZE); + memset(buf, 0, sizeof(buf)); if (_IOC_DIR(cmd) & _IOC_WRITE) { if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) return -EFAULT; diff --git a/drivers/gpu/nvgpu/gm20b/acr_gm20b.c b/drivers/gpu/nvgpu/gm20b/acr_gm20b.c index 7c6b734b..2fb3bf9d 100644 --- a/drivers/gpu/nvgpu/gm20b/acr_gm20b.c +++ b/drivers/gpu/nvgpu/gm20b/acr_gm20b.c @@ -163,7 +163,6 @@ int fecs_ucode_details(struct gk20a *g, struct flcn_ucode_img *p_img) p_img->desc = kzalloc(sizeof(struct pmu_ucode_desc), GFP_KERNEL); if (p_img->desc == NULL) { - kfree(lsf_desc); err = -ENOMEM; goto free_lsf_desc; } diff --git a/drivers/gpu/nvgpu/vgpu/gr_vgpu.c b/drivers/gpu/nvgpu/vgpu/gr_vgpu.c index 46b48b33..b1a8027e 100644 --- a/drivers/gpu/nvgpu/vgpu/gr_vgpu.c +++ b/drivers/gpu/nvgpu/vgpu/gr_vgpu.c @@ -273,6 +273,7 @@ static int vgpu_gr_alloc_channel_gr_ctx(struct gk20a *g, err = vgpu_comm_sendrecv(&msg, sizeof(msg), sizeof(msg)); if (err || msg.ret) { + kfree(gr_ctx); gk20a_vm_free_va(ch_vm, gr_ctx->gpu_va, gr_ctx->size, 0); err = -ENOMEM; } else -- cgit v1.2.2