From ec023c3ff70a263deedfacd8dfc8af907f830e06 Mon Sep 17 00:00:00 2001 From: Konsta Holtta Date: Tue, 8 Mar 2016 13:58:11 +0200 Subject: gpu: nvgpu: validate error notifier offset Make sure that the notifier object fits within the supplied buffer. Bug 1739183 Bug 1739932 Change-Id: I713574ce797ffc23cec10b5114f469dbadc68f1e Signed-off-by: Konsta Holtta Reviewed-on: http://git-master/r/1026410 (cherry picked from commit f476b93eb19b962b8760457102448bd533efc54d) Reviewed-on: http://git-master/r/1028737 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Terje Bergstrom --- drivers/gpu/nvgpu/gk20a/channel_gk20a.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'drivers') diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c index 1f63bbd8..94d12a3d 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c @@ -712,10 +712,12 @@ static int gk20a_channel_set_wdt_status(struct channel_gk20a *ch, } static int gk20a_init_error_notifier(struct channel_gk20a *ch, - struct nvgpu_set_error_notifier *args) { - void *va; - + struct nvgpu_set_error_notifier *args) +{ + struct device *dev = dev_from_gk20a(ch->g); struct dma_buf *dmabuf; + void *va; + u64 end = args->offset + sizeof(struct nvgpu_notification); if (!args->mem) { pr_err("gk20a_init_error_notifier: invalid memory handle\n"); @@ -731,6 +733,13 @@ static int gk20a_init_error_notifier(struct channel_gk20a *ch, pr_err("Invalid handle: %d\n", args->mem); return -EINVAL; } + + if (end > dmabuf->size || end < sizeof(struct nvgpu_notification)) { + dma_buf_put(dmabuf); + gk20a_err(dev, "gk20a_init_error_notifier: invalid offset\n"); + return -EINVAL; + } + /* map handle */ va = dma_buf_vmap(dmabuf); if (!va) { -- cgit v1.2.2