diff options
-rw-r--r-- | drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c b/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c index 9128959f60a7..3a8c3ff4c645 100644 --- a/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c +++ b/drivers/gpu/nvgpu/gk20a/ctrl_gk20a.c @@ -96,11 +96,10 @@ long gk20a_ctrl_dev_ioctl(struct file *filp, unsigned int cmd, unsigned long arg if ((_IOC_TYPE(cmd) != NVHOST_GPU_IOCTL_MAGIC) || (_IOC_NR(cmd) == 0) || - (_IOC_NR(cmd) > NVHOST_GPU_IOCTL_LAST)) + (_IOC_NR(cmd) > NVHOST_GPU_IOCTL_LAST) || + (_IOC_SIZE(cmd) > NVHOST_GPU_IOCTL_MAX_ARG_SIZE)) return -EFAULT; - BUG_ON(_IOC_SIZE(cmd) > NVHOST_GPU_IOCTL_MAX_ARG_SIZE); - if (_IOC_DIR(cmd) & _IOC_WRITE) { if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) return -EFAULT; |