nv-tegra-mirror/linux-nvgpu
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nvgpu.git synced 2025-12-24 10:34:43 +03:00
Code Issues Packages Projects Releases Wiki Activity

gpu: nvgpu: fix possible buffer overflow issue

Browse Source 
As sprintf() is used to populate pool_name[20], it can overflow
for larger u32 values (u32 max decimal number chars are 10) i.e.
20 < strlen("semaphore_pool-") i.e. 15 + 10.

Fix this overflow by removing pool_name as it's not used.

Bug 2626446

Change-Id: I4e0a222a2cd34dcd09e69294bc46e2242abb04bb
Signed-off-by: Nitin Kumbhar <nkumbhar@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/2205356
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: svc-mobile-misra <svc-mobile-misra@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Deepak Nibade <dnibade@nvidia.com>
Reviewed-by: Alex Waterman <alexw@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Ankur Kishore <ankkishore@nvidia.com>
Reviewed-by: Seshendra Gadagottu <sgadagottu@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
This commit is contained in:
Nitin Kumbhar
2019-09-25 14:27:57 +05:30
committed by Alex Waterman
parent f512d17e0b
commit f8e4393ace
1 changed files with 0 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/nvgpu/common/sync/channel_sync_semaphore.c
View File

@@ -337,7 +337,6 @@ nvgpu_channel_sync_semaphore_create(
{
struct nvgpu_channel_sync_semaphore *sema;
struct gk20a *g = c->g;
char pool_name[20];
int asid = -1;
int err;
@@ -352,7 +351,6 @@ nvgpu_channel_sync_semaphore_create(
}
sema->c = c;
sprintf(pool_name, "semaphore_pool-%d", c->chid);
sema->pool = c->vm->sema_pool;
if (c->vm->as_share != NULL) {