nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-22 17:25:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

drm/tegra: address INT30-C cert violations

Browse Source 
add integer overflow checks with error handling

Jira HOSTX-5889

Change-Id: Ib31763ab073c2f9b13e2f54fd3c006d977215941
Signed-off-by: Prateek Agarwal <praagarwal@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3301055
GVS: buildbot_gerritrpt <buildbot_gerritrpt@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
This commit is contained in:
praagarwal
2025-02-12 10:20:23 +00:00
committed by Jon Hunter
parent 37189ffbdd
commit 4651a49da8
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/gpu/drm/tegra/drm.c
View File

@@ -12,6 +12,7 @@
#include <linux/idr.h> #include <linux/idr.h>
#include <linux/iommu.h> #include <linux/iommu.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/overflow.h>
#include <linux/platform_device.h> #include <linux/platform_device.h>
#include <linux/pm_runtime.h> #include <linux/pm_runtime.h>
#include <linux/version.h> #include <linux/version.h>
@@ -229,7 +230,8 @@ int tegra_drm_submit(struct tegra_drm_context *context,
* Track referenced BOs so that they can be unreferenced after the * Track referenced BOs so that they can be unreferenced after the
* submission is complete. * submission is complete.
*/ */
num_refs = num_cmdbufs + num_relocs * 2; if (check_add_overflow(num_cmdbufs, num_relocs * 2, &num_refs))
return -EINVAL;
refs = kmalloc_array(num_refs, sizeof(*refs), GFP_KERNEL); refs = kmalloc_array(num_refs, sizeof(*refs), GFP_KERNEL);
if (!refs) { if (!refs) {
@@ -354,8 +356,8 @@ int tegra_drm_submit(struct tegra_drm_context *context,
args->fence = job->syncpt_end; args->fence = job->syncpt_end;
fail: fail:
while (num_refs--) while (num_refs > 0)
drm_gem_object_put(refs[num_refs]); drm_gem_object_put(refs[--num_refs]);
kfree(refs); kfree(refs);