diff options
| author | Konsta Holtta <kholtta@nvidia.com> | 2016-03-08 13:58:11 +0200 |
|---|---|---|
| committer | Matthew Pedro <mapedro@nvidia.com> | 2016-03-14 15:48:44 -0700 |
| commit | ee62433c7b903f226220e485a90cc5860da49f94 (patch) | |
| tree | f1ec0667219c21e373ac7f0f657ce24fb0845a5a /drivers/gpu | |
| parent | 9fc101e766b4c0e7f2fb7b02e44e9cd64136ae0d (diff) | |
gpu: nvgpu: validate error notifier offset
Make sure that the notifier object fits within the supplied buffer.
Bug 1739183
Bug 1739932
Change-Id: I713574ce797ffc23cec10b5114f469dbadc68f1e
Signed-off-by: Konsta Holtta <kholtta@nvidia.com>
Reviewed-on: http://git-master/r/1026410
(cherry picked from commit f476b93eb19b962b8760457102448bd533efc54d)
Reviewed-on: http://git-master/r/1029379
GVS: Gerrit_Virtual_Submit
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/nvgpu/gk20a/channel_gk20a.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c index 755fcdda5742..e00a1af5b77d 100644 --- a/drivers/gpu/nvgpu/gk20a/channel_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/channel_gk20a.c @@ -538,10 +538,12 @@ static int gk20a_channel_cycle_stats(struct channel_gk20a *ch, #endif static int gk20a_init_error_notifier(struct channel_gk20a *ch, - struct nvhost_set_error_notifier *args) { - void *va; - + struct nvhost_set_error_notifier *args) +{ + struct device *dev = dev_from_gk20a(ch->g); struct dma_buf *dmabuf; + void *va; + u64 end = args->offset + sizeof(struct nvhost_notification); if (!args->mem) { pr_err("gk20a_init_error_notifier: invalid memory handle\n"); @@ -557,6 +559,13 @@ static int gk20a_init_error_notifier(struct channel_gk20a *ch, pr_err("Invalid handle: %d\n", args->mem); return -EINVAL; } + + if (end > dmabuf->size || end < sizeof(struct nvhost_notification)) { + dma_buf_put(dmabuf); + gk20a_err(dev, "gk20a_init_error_notifier: invalid offset\n"); + return -EINVAL; + } + /* map handle */ va = dma_buf_vmap(dmabuf); if (!va) { |