nv-tegra-mirror/linux-nvgpu
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nvgpu.git synced 2025-12-22 17:36:20 +03:00
Code Issues Packages Projects Releases Wiki Activity

gpu: nvgpu: Fix out-of-bound access

Browse Source 
Make sure the index used to access gpc_tpc_physical_id_map does not
exceed the range.

Bug 4566775

Change-Id: I863f4b4d06c8ace3b58b8c3fdc60f9d466846072
Signed-off-by: Chun Ng <chunn@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvgpu/+/3341829
Tested-by: Aasta Lin <aastal@nvidia.com>
Reviewed-by: Vijayakumar Subbu <vsubbu@nvidia.com>
Reviewed-by: svcacv <svcacv@nvidia.com>
GVS: buildbot_gerritrpt <buildbot_gerritrpt@nvidia.com>
This commit is contained in:
Chun Ng
2024-04-30 16:58:35 -07:00
committed by mobile promotions
parent af45c11d05
commit b37344e9d7
1 changed files with 10 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
drivers/gpu/nvgpu/common/gr/gr_config.c
View File

@@ -1,24 +1,5 @@
/* // SPDX-License-Identifier: GPL-2.0-only OR MIT
* Copyright (c) 2019-2023, NVIDIA CORPORATION. All rights reserved. // SPDX-FileCopyrightText: Copyright (c) 2019-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
*
* Permission is hereby granted, free of charge, to any person obtaining a
* copy of this software and associated documentation files (the "Software"),
* to deal in the Software without restriction, including without limitation
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
* and/or sell copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
* DEALINGS IN THE SOFTWARE.
*/
#include <nvgpu/gk20a.h> #include <nvgpu/gk20a.h>
#include <nvgpu/io.h> #include <nvgpu/io.h>
@@ -686,8 +667,9 @@ struct nvgpu_gr_config *nvgpu_gr_config_init(struct gk20a *g)
* logical id. * logical id.
*/ */
config->gpc_tpc_physical_id_map = nvgpu_kzalloc(g, config->gpc_tpc_physical_id_map = nvgpu_kzalloc(g,
nvgpu_safe_mult_u32((size_t)config->gpc_count, nvgpu_safe_mult_u32(
sizeof(u32 *))); nvgpu_safe_cast_u64_to_u32((size_t)config->max_gpc_count),
(u32)sizeof(u32 *)));
if (config->gpc_tpc_physical_id_map == NULL) { if (config->gpc_tpc_physical_id_map == NULL) {
nvgpu_err(g, "alloc gpc_tpc_physical_id_map failed"); nvgpu_err(g, "alloc gpc_tpc_physical_id_map failed");
goto clean_up_gpc_rop_config; goto clean_up_gpc_rop_config;
@@ -696,6 +678,11 @@ struct nvgpu_gr_config *nvgpu_gr_config_init(struct gk20a *g)
for (gpc_index = 0; gpc_index < config->gpc_count; gpc_index++) { for (gpc_index = 0; gpc_index < config->gpc_count; gpc_index++) {
gpc_phys_id = nvgpu_grmgr_get_gr_gpc_phys_id(g, gpc_phys_id = nvgpu_grmgr_get_gr_gpc_phys_id(g,
cur_gr_instance, (u32)gpc_index); cur_gr_instance, (u32)gpc_index);
if (gpc_phys_id >= config->max_gpc_count) {
nvgpu_err(g, "gpc_phys_id: %u is >= max_gpc_count: %u",
gpc_phys_id, config->max_gpc_count);
goto clean_up_gpc_tpc_physical_id_map_alloc_fail;
}
config->gpc_tpc_physical_id_map[gpc_phys_id] = config->gpc_tpc_physical_id_map[gpc_phys_id] =
nvgpu_kzalloc(g, nvgpu_safe_mult_u32( nvgpu_kzalloc(g, nvgpu_safe_mult_u32(
config->max_tpc_per_gpc_count, sizeof(u32))); config->max_tpc_per_gpc_count, sizeof(u32)));