gpu: nvgpu: validate wait notification offset
Konsta Holtta [Tue, 8 Mar 2016 12:35:21 +0000 (14:35 +0200)]
Make sure that the notification object fits within the supplied buffer.

Bug 1739182

Change-Id: Ifb66f848e3758438f37645be6f534f5b60260214
Reviewed-on: http://git-master/r/1026431
Signed-off-by: Konsta Holtta <kholtta@nvidia.com>
(cherry-picked from commit <TODO>)
Reviewed-on: http://git-master/r/1029635
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>
Tested-by: Manish Tuteja <mtuteja@nvidia.com>

drivers/gpu/nvgpu/gk20a/channel_gk20a.c

index 169242a..09dbd3a 100644 (file)
@@ -1,7 +1,7 @@
 /*
  * GK20A Graphics channel
  *
- * Copyright (c) 2011-2015, NVIDIA CORPORATION.  All rights reserved.
+ * Copyright (c) 2011-2016, NVIDIA CORPORATION.  All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -2057,6 +2057,7 @@ static int gk20a_channel_wait(struct channel_gk20a *ch,
        u32 offset;
        unsigned long timeout;
        int remain, ret = 0;
+       u64 end;
 
        gk20a_dbg_fn("");
 
@@ -2072,6 +2073,7 @@ static int gk20a_channel_wait(struct channel_gk20a *ch,
        case NVGPU_WAIT_TYPE_NOTIFIER:
                id = args->condition.notifier.dmabuf_fd;
                offset = args->condition.notifier.offset;
+               end = offset + sizeof(struct notification);
 
                dmabuf = dma_buf_get(id);
                if (IS_ERR(dmabuf)) {
@@ -2080,6 +2082,12 @@ static int gk20a_channel_wait(struct channel_gk20a *ch,
                        return -EINVAL;
                }
 
+               if (end > dmabuf->size || end < sizeof(struct notification)) {
+                       dma_buf_put(dmabuf);
+                       gk20a_err(d, "invalid notifier offset\n");
+                       return -EINVAL;
+               }
+
                notif = dma_buf_vmap(dmabuf);
                if (!notif) {
                        gk20a_err(d, "failed to map notifier memory");