From 4d3df9deae33cf4bafdac07cb10ccb54e0519237 Mon Sep 17 00:00:00 2001
From: Vinod G <vinodg@nvidia.com>
Date: Mon, 13 May 2019 16:40:47 -0700
Subject: [PATCH] gpu: nvgpu: Fix CERT INT30-C error in commom.gr

Fix CERT INT30-C error in common.gr unit

Error- Unsigned integer operation "gpc_stride * gpc" may wrap.
Error- Unsigned integer operation "tpc_stride * tpc" may wrap.
Use nvgpu_secure_mult_u32 function to do wrap checking.

Error- Signed integer operation ctxsw_disable_count++ may overflow
Add checking and return error.
_
Jira NVGPU-3411

Change-Id: I6e52283ee1a1e883e0195bde79fc69d58f71d5c9
Signed-off-by: Vinod G <vinodg@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/2118147
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Seshendra Gadagottu <sgadagottu@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
---
 drivers/gpu/nvgpu/common/gr/gr.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/nvgpu/common/gr/gr.c b/drivers/gpu/nvgpu/common/gr/gr.c
index 7444c10b6..87aa69c7f 100644
--- a/drivers/gpu/nvgpu/common/gr/gr.c
+++ b/drivers/gpu/nvgpu/common/gr/gr.c
@@ -23,6 +23,8 @@
 #include <nvgpu/gk20a.h>
 #include <nvgpu/io.h>
 #include <nvgpu/unit.h>
+#include <nvgpu/errno.h>
+#include <nvgpu/secure_ops.h>
 #include <nvgpu/gr/gr.h>
 #include <nvgpu/gr/config.h>
 #include <nvgpu/gr/gr_intr.h>
@@ -113,7 +115,7 @@ u32 nvgpu_gr_get_no_of_sm(struct gk20a *g)
 u32 nvgpu_gr_gpc_offset(struct gk20a *g, u32 gpc)
 {
 	u32 gpc_stride = nvgpu_get_litter_value(g, GPU_LIT_GPC_STRIDE);
-	u32 gpc_offset = gpc_stride * gpc;
+	u32 gpc_offset = nvgpu_secure_mult_u32(gpc_stride , gpc);
 
 	return gpc_offset;
 }
@@ -122,7 +124,7 @@ u32 nvgpu_gr_tpc_offset(struct gk20a *g, u32 tpc)
 {
 	u32 tpc_in_gpc_stride = nvgpu_get_litter_value(g,
 					GPU_LIT_TPC_IN_GPC_STRIDE);
-	u32 tpc_offset = tpc_in_gpc_stride * tpc;
+	u32 tpc_offset = nvgpu_secure_mult_u32(tpc_in_gpc_stride, tpc);
 
 	return tpc_offset;
 }
@@ -695,6 +697,13 @@ int nvgpu_gr_disable_ctxsw(struct gk20a *g)
 	nvgpu_log(g, gpu_dbg_fn | gpu_dbg_gpu_dbg, " ");
 
 	nvgpu_mutex_acquire(&gr->ctxsw_disable_mutex);
+
+	/* check for gr->ctxsw_disable_count overflow */
+	if (INT_MAX < gr->ctxsw_disable_count) {
+		nvgpu_err(g, "ctxsw_disable_count overflow");
+		return -ERANGE;
+	}
+
 	gr->ctxsw_disable_count++;
 	if (gr->ctxsw_disable_count == 1) {
 		err = nvgpu_pg_elpg_disable(g);