From b37344e9d7c4006c016c5aef323d7dff8642b569 Mon Sep 17 00:00:00 2001 From: Chun Ng Date: Tue, 30 Apr 2024 16:58:35 -0700 Subject: [PATCH] gpu: nvgpu: Fix out-of-bound access Make sure the index used to access gpc_tpc_physical_id_map does not exceed the range. Bug 4566775 Change-Id: I863f4b4d06c8ace3b58b8c3fdc60f9d466846072 Signed-off-by: Chun Ng Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvgpu/+/3341829 Tested-by: Aasta Lin Reviewed-by: Vijayakumar Subbu Reviewed-by: svcacv GVS: buildbot_gerritrpt --- drivers/gpu/nvgpu/common/gr/gr_config.c | 33 ++++++++----------------- 1 file changed, 10 insertions(+), 23 deletions(-) diff --git a/drivers/gpu/nvgpu/common/gr/gr_config.c b/drivers/gpu/nvgpu/common/gr/gr_config.c index c86bba610..42cf68798 100644 --- a/drivers/gpu/nvgpu/common/gr/gr_config.c +++ b/drivers/gpu/nvgpu/common/gr/gr_config.c @@ -1,24 +1,5 @@ -/* - * Copyright (c) 2019-2023, NVIDIA CORPORATION. All rights reserved. - * - * Permission is hereby granted, free of charge, to any person obtaining a - * copy of this software and associated documentation files (the "Software"), - * to deal in the Software without restriction, including without limitation - * the rights to use, copy, modify, merge, publish, distribute, sublicense, - * and/or sell copies of the Software, and to permit persons to whom the - * Software is furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL - * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - * DEALINGS IN THE SOFTWARE. - */ +// SPDX-License-Identifier: GPL-2.0-only OR MIT +// SPDX-FileCopyrightText: Copyright (c) 2019-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved. #include #include @@ -686,8 +667,9 @@ struct nvgpu_gr_config *nvgpu_gr_config_init(struct gk20a *g) * logical id. */ config->gpc_tpc_physical_id_map = nvgpu_kzalloc(g, - nvgpu_safe_mult_u32((size_t)config->gpc_count, - sizeof(u32 *))); + nvgpu_safe_mult_u32( + nvgpu_safe_cast_u64_to_u32((size_t)config->max_gpc_count), + (u32)sizeof(u32 *))); if (config->gpc_tpc_physical_id_map == NULL) { nvgpu_err(g, "alloc gpc_tpc_physical_id_map failed"); goto clean_up_gpc_rop_config; @@ -696,6 +678,11 @@ struct nvgpu_gr_config *nvgpu_gr_config_init(struct gk20a *g) for (gpc_index = 0; gpc_index < config->gpc_count; gpc_index++) { gpc_phys_id = nvgpu_grmgr_get_gr_gpc_phys_id(g, cur_gr_instance, (u32)gpc_index); + if (gpc_phys_id >= config->max_gpc_count) { + nvgpu_err(g, "gpc_phys_id: %u is >= max_gpc_count: %u", + gpc_phys_id, config->max_gpc_count); + goto clean_up_gpc_tpc_physical_id_map_alloc_fail; + } config->gpc_tpc_physical_id_map[gpc_phys_id] = nvgpu_kzalloc(g, nvgpu_safe_mult_u32( config->max_tpc_per_gpc_count, sizeof(u32)));