nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-24 02:01:36 +03:00
Code Issues Packages Projects Releases Wiki Activity

tegra: nvmap: Fix overflow CERT C SAST defects

Browse Source 
Fix subtraction CERT-C overflow defects using check_sub_overflow and
addition CERT-C overflow defects using check_add_overflow, in
nvmap_heap.c and nvmap_init.c files.

Fix count:
- CERT-C INT08-C: 3
- CERT-C INT32-C: 3

Bug 4479044

Change-Id: I337a4cf11f3f94e05243070e08c0b1fc2448d276
Signed-off-by: N V S Abhishek <nabhishek@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3263324
Reviewed-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
Reviewed-by: svcacv <svcacv@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
GVS: buildbot_gerritrpt <buildbot_gerritrpt@nvidia.com>
This commit is contained in:
N V S Abhishek
2024-12-06 10:32:13 +00:00
committed by Jon Hunter
parent 281c0247df
commit 16d2204183
2 changed files with 30 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/video/tegra/nvmap/nvmap_heap.c
View File

@@ -1093,7 +1093,7 @@ void nvmap_heap_destroy(struct nvmap_heap *heap)
int nvmap_heap_init(void)
{
ulong start_time = sched_clock();
ulong sum;
ulong result;
heap_block_cache = KMEM_CACHE(list_block, 0);
if (!heap_block_cache) {
@@ -1101,10 +1101,11 @@ int nvmap_heap_init(void)
return -ENOMEM;
}
pr_info("%s: created heap block cache\n", __func__);
if (check_add_overflow((ulong)sched_clock() - start_time, nvmap_init_time, &sum))
if (check_sub_overflow((ulong)sched_clock(), start_time, &result) ||
check_add_overflow(nvmap_init_time, result, &result))
return -EOVERFLOW;
nvmap_init_time = sum;
nvmap_init_time = result;
return 0;
}

33
drivers/video/tegra/nvmap/nvmap_init.c
View File

@@ -153,7 +153,7 @@ static int __init nvmap_populate_ivm_carveout(struct device *dev)
struct of_phandle_iterator it;
struct tegra_hv_ivm_cookie *ivm;
unsigned long long id;
unsigned int guestid;
unsigned int guestid, result;
if (!of_phandle_iterator_init(&it, dev->of_node, "memory-region", NULL, 0)) {
while (!of_phandle_iterator_next(&it) && it.node) {
@@ -222,7 +222,15 @@ static int __init nvmap_populate_ivm_carveout(struct device *dev)
pr_info("IVM carveout IPA:%p, size=%zu, peer vmid=%u, name=%s\n",
(void *)(uintptr_t)co->base, co->size, co->peer, name);
co->name = name;
nvmap_data.nr_carveouts++;
if (check_add_overflow(nvmap_data.nr_carveouts, 1U, &result)) {
co->name = NULL;
kfree(name);
ret = -EINVAL;
goto fail;
}
nvmap_data.nr_carveouts = result;
}
}
@@ -337,12 +345,15 @@ static const struct reserved_mem_ops nvmap_co_ops = {
static int __init nvmap_co_setup(struct reserved_mem *rmem)
{
struct nvmap_platform_carveout *co;
ulong start = sched_clock();
ulong start_time = sched_clock();
int ret = 0;
ulong result;
co = nvmap_get_carveout_pdata(rmem->name);
if (co == NULL)
return ret;
if (co == NULL) {
ret = -ENOMEM;
goto exit;
}
rmem->ops = &nvmap_co_ops;
rmem->priv = co;
@@ -351,7 +362,12 @@ static int __init nvmap_co_setup(struct reserved_mem *rmem)
co->size = rmem->size;
co->cma_dev = NULL;
nvmap_init_time += sched_clock() - start;
if (check_sub_overflow((ulong)sched_clock(), start_time, &result) ||
check_add_overflow(nvmap_init_time, result, &result))
return -EOVERFLOW;
nvmap_init_time = result;
exit:
return ret;
}
@@ -379,7 +395,10 @@ int __init nvmap_init(struct platform_device *pdev)
compp);
return -EINVAL;
}
nvmap_co_setup(rmem2);
err = nvmap_co_setup(rmem2);
if (err)
goto end;
}
}
}