nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-22 09:11:26 +03:00
Code Issues Packages Projects Releases Wiki Activity

gpu: host1x: address INT30-C cert violations

Browse Source 
add checks for integer overflow in job.c

Jira HOSTX-5889

Change-Id: Id3336c5c390f2ce771492a686a57e47cc9adf9d2
Signed-off-by: Prateek Agarwal <praagarwal@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3299139
GVS: buildbot_gerritrpt <buildbot_gerritrpt@nvidia.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
This commit is contained in:
praagarwal
2025-02-09 14:20:02 +00:00
committed by Jon Hunter
parent 6b5633fb93
commit 4a4300f0e8
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/gpu/host1x/job.c
View File

@@ -11,6 +11,7 @@
#include <linux/iommu.h> #include <linux/iommu.h>
#include <linux/kref.h> #include <linux/kref.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/overflow.h>
#include <linux/scatterlist.h> #include <linux/scatterlist.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/vmalloc.h> #include <linux/vmalloc.h>
@@ -35,9 +36,10 @@ struct host1x_job *host1x_job_alloc(struct host1x_channel *ch,
enable_firewall = IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && !skip_firewall; enable_firewall = IS_ENABLED(CONFIG_TEGRA_HOST1X_FIREWALL) && !skip_firewall;
if (!enable_firewall) if (!enable_firewall) {
num_unpins += num_cmdbufs; if (check_add_overflow(num_unpins, num_cmdbufs, &num_unpins))
return NULL;
}
/* Check that we're not going to overflow */ /* Check that we're not going to overflow */
total = sizeof(struct host1x_job) + total = sizeof(struct host1x_job) +
(u64)num_relocs * sizeof(struct host1x_reloc) + (u64)num_relocs * sizeof(struct host1x_reloc) +
@@ -559,7 +561,8 @@ static inline int copy_gathers(struct device *host, struct host1x_job *job,
g = &job->cmds[i].gather; g = &job->cmds[i].gather;
size += g->words * sizeof(u32); if (check_add_overflow(size, g->words * sizeof(u32), &size))
return -EOVERFLOW;
} }
/* /*