nv-tegra-mirror/linux-nv-oot
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nv-oot.git synced 2025-12-25 02:32:08 +03:00
Code Issues Packages Projects Releases Wiki Activity

tegra: nvmap: Decrement variable with correct value to avoid wrap around

Browse Source 
Decrement hrange->offs_start with hs[i]->size instead of tot_sz. tot_sz
holds the cumulitive sum of hs[0...i]->size and decrementing this from
hrange->offs_start will decrement values from 0..(i-1) multiple times,
which is incorrect and can cause a wrap around.

Bug 4479044

Change-Id: If6afe9f05fc0d246d42a95fa6d9708361efcc9f8
Signed-off-by: N V S Abhishek <nabhishek@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3263927
Reviewed-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-by: Sachin Nikam <snikam@nvidia.com>
This commit is contained in:
N V S Abhishek
2024-12-08 14:42:08 +00:00
committed by Jon Hunter
parent 9ab979381c
commit caaae6b1d9
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/video/tegra/nvmap/nvmap_handle.c
View File

@@ -139,7 +139,7 @@ int find_range_of_handles(struct nvmap_handle **hs, u32 nr,
tot_sz = sum;
if (offs > tot_sz) {
if (check_sub_overflow(hrange->offs_start, tot_sz, &difference))
if (check_sub_overflow(hrange->offs_start, (u64)hs[i]->size, &difference))
return -EOVERFLOW;
hrange->offs_start = difference;