nv-tegra-mirror/linux-nvgpu
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nvgpu.git synced 2025-12-25 02:52:51 +03:00
Code Issues Packages Projects Releases Wiki Activity

gpu: nvgpu: fix use of untrusted scalar value

Browse Source 
Kind value can be passed to API nvgpu_vm_map() from User
space (through IOCTL NVGPU_AS_IOCTL_MAP_BUFFER_EX)

But kind value is not checked for sane values
before storing it in bfr.kind_v
And then we use this kind value as array index
in gk20a_kind_is_supported() which is incorrect

Fix this by ensuring in nvgpu_vm_map() that the
kind value is well within range

Bug 200291879
Coverity id : 2567923
Coverity id : 2567924

Change-Id: Ic57395018727cbd2260c929581db256e427316c6
Signed-off-by: Deepak Nibade <dnibade@nvidia.com>
Reviewed-on: http://git-master/r/1496597
GVS: Gerrit_Virtual_Submit
Reviewed-by: svccoveritychecker <svccoveritychecker@nvidia.com>
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
This commit is contained in:
Deepak Nibade
2017-06-05 16:02:46 +05:30
committed by mobile promotions
parent 793bc318c5
commit 9902a49b0b
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/nvgpu/gk20a/kind_gk20a.c
View File

@@ -408,11 +408,11 @@ void gk20a_init_uncompressed_kind_map(void)
gmmu_pte_kind_x8c24_v();
}
u16 gk20a_kind_attr[256];
u16 gk20a_kind_attr[NV_KIND_ATTR_SIZE];
void gk20a_init_kind_attr(void)
{
u16 k;
for (k = 0; k < 256; k++) {
for (k = 0; k < NV_KIND_ATTR_SIZE; k++) {
gk20a_kind_attr[k] = 0;
if (gk20a_kind_supported((u8)k))
gk20a_kind_attr[k] |= GK20A_KIND_ATTR_SUPPORTED;