nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-23 01:31:30 +03:00
Code Issues Packages Projects Releases Wiki Activity

video: tegra: nvmap: Fix overflow condition

Browse Source 
When the carveout size is changed to 2GB, mem->size << PAGE_SHIFT will
overflow the int limit and get wrapped to negative value. Hence
during freeing bitmap, one of the comparison condition is not meeting,
resulting into not freeing bitmap. Ultimately the entire bitmap get
consumed even though it is expected to have empty bits. Fix this by
typecasting the size to u64.

Bug 3962552

Change-Id: Ieaf93a3a91062d3f630921259aa9b3935853e91c
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2861614
Reviewed-by: svcacv <svcacv@nvidia.com>
Reviewed-by: svc_kernel_abi <svc_kernel_abi@nvidia.com>
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svc-mobile-cert <svc-mobile-cert@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
This commit is contained in:
Ketan Patil
2023-02-22 11:29:43 +00:00
committed by Laxman Dewangan
parent fd4635f259
commit 8a01798884
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/video/tegra/nvmap/nvmap_init.c
View File

@@ -398,7 +398,7 @@ static void *__nvmap_dma_alloc_from_coherent(struct device *dev,
spin_lock_irqsave(&mem->spinlock, flags);
if (unlikely(size > (mem->size << PAGE_SHIFT)))
if (unlikely(size > ((u64)mem->size << PAGE_SHIFT)))
goto err;
if ((mem->flags & DMA_MEMORY_NOMAP) &&
@@ -507,7 +507,7 @@ void nvmap_dma_free_attrs(struct device *dev, size_t size, void *cpu_addr,
mem_addr = mem->virt_base;
if (mem && cpu_addr >= mem_addr &&
cpu_addr - mem_addr < mem->size << PAGE_SHIFT) {
cpu_addr - mem_addr < (u64)mem->size << PAGE_SHIFT) {
unsigned int page = (cpu_addr - mem_addr) >> PAGE_SHIFT;
unsigned long flags;
unsigned int count;