nv-tegra-mirror/linux-nvgpu
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nvgpu.git synced 2025-12-22 17:36:20 +03:00
Code Issues Packages Projects Releases Wiki Activity

gpu: nvgpu: require mapped buffer be inside va

Browse Source 
When validating buffers to be mapped, check that the buffer end does not
overflow over the virtual address node space.

Bug 1562361

Change-Id: I3c78ec7380584ae55f1e6bf576f524abee846ddd
Signed-off-by: Konsta Holtta <kholtta@nvidia.com>
This commit is contained in:
Konsta Holtta
2014-10-09 16:37:36 +03:00
committed by Dan Willemsen
parent 835be94af5
commit 026781c82c
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/gpu/nvgpu/gk20a/mm_gk20a.c
View File

@@ -1080,6 +1080,13 @@ static int validate_fixed_buffer(struct vm_gk20a *vm,
struct device *dev = dev_from_vm(vm); struct device *dev = dev_from_vm(vm);
struct vm_reserved_va_node *va_node; struct vm_reserved_va_node *va_node;
struct mapped_buffer_node *buffer; struct mapped_buffer_node *buffer;
u64 map_end = map_offset + map_size;
/* can wrap around with insane map_size; zero is disallowed too */
if (map_end <= map_offset) {
gk20a_warn(dev, "fixed offset mapping with invalid map_size");
return -EINVAL;
}
if (map_offset & gmmu_page_offset_masks[bfr->pgsz_idx]) { if (map_offset & gmmu_page_offset_masks[bfr->pgsz_idx]) {
gk20a_err(dev, "map offset must be buffer page size aligned 0x%llx", gk20a_err(dev, "map offset must be buffer page size aligned 0x%llx",
@@ -1094,6 +1101,12 @@ static int validate_fixed_buffer(struct vm_gk20a *vm,
return -EINVAL; return -EINVAL;
} }
/* mapped area should fit inside va */
if (map_end > va_node->vaddr_start + va_node->size) {
gk20a_warn(dev, "fixed offset mapping size overflows va node");
return -EINVAL;
}
/* check that this mappings does not collide with existing /* check that this mappings does not collide with existing
* mappings by checking the overlapping area between the current * mappings by checking the overlapping area between the current
* buffer and all other mapped buffers */ * buffer and all other mapped buffers */