Martin Radev 38e6c9ae98 gpu: nvgpu: Check for int overflow in MAPPING_MODIFY path ...

The check `buffer_offset + buffer_size > mapped_buffer->size` can
be bypassed with a large `buffer_size`, and that may lead to some
corruption. This patch combines the bounds checks into a more
robust one.

Jira NVGPU-6374

Change-Id: I55c8664134e763c66715bf3492867bc73686b694
Signed-off-by: Martin Radev <mradev@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvgpu/+/2504890
Reviewed-by: Scott Long <scottl@nvidia.com>
Reviewed-by: Alex Waterman <alexw@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
GVS: Gerrit_Virtual_Submit
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>

2021-03-26 14:20:18 -07:00

12 KiB

Raw Blame History

View Raw