From 976ca5efb1c3f25f2376f761ba13d2363d88fa83 Mon Sep 17 00:00:00 2001 From: N V S Abhishek Date: Fri, 6 Dec 2024 00:14:59 +0000 Subject: [PATCH] tegra: nvmap: Fix overflow CERT defects in nvmap_alloc.c Fix addition overflow defects in nvmap_alloc.c by using overflow.h APIs. Fix 4 CERT INT 08-C and 3 CERT INT 30-C defects. Bug 4479044 Change-Id: Id4f9d8a5fd15e3ded38d31b58c8ab3693ab1707e Signed-off-by: N V S Abhishek Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3262969 Reviewed-by: Sachin Nikam GVS: buildbot_gerritrpt Reviewed-by: Ketan Patil --- drivers/video/tegra/nvmap/nvmap_alloc.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/video/tegra/nvmap/nvmap_alloc.c b/drivers/video/tegra/nvmap/nvmap_alloc.c index 6b219d08..c0c53f60 100644 --- a/drivers/video/tegra/nvmap/nvmap_alloc.c +++ b/drivers/video/tegra/nvmap/nvmap_alloc.c @@ -102,6 +102,7 @@ static int handle_page_alloc(struct nvmap_client *client, int i = 0, page_index = 0, allocated = 0; struct page **pages; gfp_t gfp = GFP_NVMAP | __GFP_ZERO; + u64 result; #ifdef CONFIG_ARM64_4K_PAGES #ifdef NVMAP_CONFIG_PAGE_POOLS int pages_per_big_pg = NVMAP_PP_BIG_PAGE_SIZE >> PAGE_SHIFT; @@ -152,7 +153,11 @@ static int handle_page_alloc(struct nvmap_client *client, pages[i + idx] = nth_page(page, idx); nvmap_clean_cache(&pages[i], pages_per_big_pg); } - nvmap_big_page_allocs += page_index; + + if (check_add_overflow(nvmap_big_page_allocs, (u64)page_index, &result)) + goto fail; + + nvmap_big_page_allocs = result; #endif /* CONFIG_ARM64_4K_PAGES */ #ifdef NVMAP_CONFIG_PAGE_POOLS /* Get as many pages from the pool as possible. */ @@ -174,7 +179,11 @@ static int handle_page_alloc(struct nvmap_client *client, if (pages[i] == NULL) goto fail; } - nvmap_total_page_allocs += nr_page; + + if (check_add_overflow(nvmap_big_page_allocs, (u64)nr_page, &result)) + goto fail; + + nvmap_total_page_allocs = result; } /*