nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-24 10:11:26 +03:00
Code Issues Packages Projects Releases Wiki Activity

nvdla: kmd: fix upper bound check on fence limit

Browse Source 
1. In Linux, MAX_NVDLA_*FENCES_PER_TASK is not same as that
   of MAX_NVDLA_EMU_*FENCES_PER_TASK. So there is an issue of
   buffer overflow during copy_from_user.
2. This commit fixes the issue by making use of EMU limits as
   the upper bound.

Bug 3613311

Change-Id: Ibfcc7e871aea0b44576a690c60491777a4752003
Signed-off-by: Arvind M <am@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2758528
Reviewed-by: svcacv <svcacv@nvidia.com>
Reviewed-by: svc_kernel_abi <svc_kernel_abi@nvidia.com>
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svc-mobile-cert <svc-mobile-cert@nvidia.com>
Reviewed-by: Gunjan Mehta <gmehta@nvidia.com>
Reviewed-by: Amit Sharma (SW-TEGRA) <amisharma@nvidia.com>
Reviewed-by: Praveen K <kpraveen@nvidia.com>
GVS: Gerrit_Virtual_Submit <buildbot_gerritrpt@nvidia.com>
This commit is contained in:
Arvind M
2022-08-09 22:50:06 +05:30
committed by Laxman Dewangan
parent f8f9637506
commit c7726fd7d3
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/video/tegra/host/nvdla/nvdla_ioctl.c
View File

@@ -896,18 +896,18 @@ static int nvdla_emu_task_submit(struct nvdla_private *priv, void *arg)
nvdla_dbg_info(pdev, "submit [%d]th task", i + 1);
if (local_task.num_prefences > MAX_NVDLA_PREFENCES_PER_TASK) {
if (local_task.num_prefences > MAX_NVDLA_EMU_PREFENCES_PER_TASK) {
nvdla_dbg_err(pdev, "#prefences[%u] > expected[%d]\n",
local_task.num_prefences,
MAX_NVDLA_PREFENCES_PER_TASK);
MAX_NVDLA_EMU_PREFENCES_PER_TASK);
err = -EINVAL;
goto exit;
}
if (local_task.num_postfences > MAX_NVDLA_POSTFENCES_PER_TASK) {
if (local_task.num_postfences > MAX_NVDLA_EMU_POSTFENCES_PER_TASK) {
nvdla_dbg_err(pdev, "#postfences[%u] > expected[%d]\n",
local_task.num_postfences,
MAX_NVDLA_POSTFENCES_PER_TASK);
MAX_NVDLA_EMU_POSTFENCES_PER_TASK);
err = -EINVAL;
goto exit;
}