diff options
Diffstat (limited to 'drivers/video/tegra/nvmap')
| -rw-r--r-- | drivers/video/tegra/nvmap/nvmap.c | 29 | ||||
| -rw-r--r-- | drivers/video/tegra/nvmap/nvmap_dmabuf.c | 19 | ||||
| -rw-r--r-- | drivers/video/tegra/nvmap/nvmap_ioctl.c | 90 | ||||
| -rw-r--r-- | drivers/video/tegra/nvmap/nvmap_mm.c | 15 | ||||
| -rw-r--r-- | drivers/video/tegra/nvmap/nvmap_priv.h | 11 |
5 files changed, 92 insertions, 72 deletions
diff --git a/drivers/video/tegra/nvmap/nvmap.c b/drivers/video/tegra/nvmap/nvmap.c index 16eeeb2638d5..662646a2d6c6 100644 --- a/drivers/video/tegra/nvmap/nvmap.c +++ b/drivers/video/tegra/nvmap/nvmap.c @@ -3,7 +3,7 @@ * * Memory manager for Tegra GPU * - * Copyright (c) 2009-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2009-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -196,6 +196,9 @@ void *__nvmap_kmap(struct nvmap_handle *h, unsigned int pagenum) if (!h) return NULL; + if (!h->alloc) + goto out; + if (pagenum >= h->size >> PAGE_SHIFT) goto out; prot = nvmap_pgprot(h, PG_PROT_KERNEL); @@ -222,7 +225,7 @@ void __nvmap_kunmap(struct nvmap_handle *h, unsigned int pagenum, phys_addr_t paddr; struct vm_struct *area = NULL; - if (!h || + if (!h || !h->alloc || WARN_ON(!virt_addr_valid(h)) || WARN_ON(!addr)) return; @@ -265,6 +268,9 @@ void *__nvmap_mmap(struct nvmap_handle *h) if (!h) return NULL; + if (!h->alloc) + goto put_handle; + prot = nvmap_pgprot(h, PG_PROT_KERNEL); if (h->heap_pgalloc) { @@ -273,7 +279,7 @@ void *__nvmap_mmap(struct nvmap_handle *h) pages = nvmap_pages(h->pgalloc.pages, h->size >> PAGE_SHIFT); if (!pages) - return NULL; + goto put_handle; vaddr = vm_map_ram(pages, h->size >> PAGE_SHIFT, -1, prot); nvmap_altfree(pages, @@ -293,10 +299,8 @@ void *__nvmap_mmap(struct nvmap_handle *h) adj_size = PAGE_ALIGN(adj_size); v = alloc_vm_area(adj_size, 0); - if (!v) { - nvmap_handle_put(h); - return NULL; - } + if (!v) + goto put_handle; p = v->addr + (h->carveout->base & ~PAGE_MASK); ioremap_page_range((ulong)v->addr, (ulong)v->addr + adj_size, @@ -306,11 +310,14 @@ void *__nvmap_mmap(struct nvmap_handle *h) * the handle will not be freed while the kernel mapping exists. * nvmap_handle_put will be called by unmapping this address */ return p; +put_handle: + nvmap_handle_put(h); + return NULL; } void __nvmap_munmap(struct nvmap_handle *h, void *addr) { - if (!h || + if (!h || !h->alloc || WARN_ON(!virt_addr_valid(h)) || WARN_ON(!addr)) return; @@ -444,6 +451,11 @@ struct sg_table *__nvmap_sg_table(struct nvmap_client *client, if (!h) return ERR_PTR(-EINVAL); + if (!h->alloc) { + err = -EINVAL; + goto put_handle; + } + npages = PAGE_ALIGN(h->size) >> PAGE_SHIFT; sgt = kzalloc(sizeof(*sgt), GFP_KERNEL); if (!sgt) { @@ -473,6 +485,7 @@ struct sg_table *__nvmap_sg_table(struct nvmap_client *client, err: kfree(sgt); +put_handle: nvmap_handle_put(h); return ERR_PTR(err); } diff --git a/drivers/video/tegra/nvmap/nvmap_dmabuf.c b/drivers/video/tegra/nvmap/nvmap_dmabuf.c index e0ade759a340..d5b0c8805766 100644 --- a/drivers/video/tegra/nvmap/nvmap_dmabuf.c +++ b/drivers/video/tegra/nvmap/nvmap_dmabuf.c @@ -599,7 +599,6 @@ err_nomem: int __nvmap_dmabuf_fd(struct nvmap_client *client, struct dma_buf *dmabuf, int flags) { - int fd; int start_fd = CONFIG_NVMAP_FD_START; #ifdef CONFIG_NVMAP_DEFER_FD_RECYCLE @@ -615,14 +614,8 @@ int __nvmap_dmabuf_fd(struct nvmap_client *client, * __FD_SETSIZE limitation issue for select(), * pselect() syscalls. */ - fd = __alloc_fd(current->files, start_fd, - sysctl_nr_open, flags); - if (fd < 0) - return fd; - - fd_install(fd, dmabuf->file); - - return fd; + return __alloc_fd(current->files, start_fd, + sysctl_nr_open, flags); } int nvmap_get_dmabuf_fd(struct nvmap_client *client, struct nvmap_handle *h) @@ -634,12 +627,8 @@ int nvmap_get_dmabuf_fd(struct nvmap_client *client, struct nvmap_handle *h) if (IS_ERR(dmabuf)) return PTR_ERR(dmabuf); fd = __nvmap_dmabuf_fd(client, dmabuf, O_CLOEXEC); - if (fd < 0) - goto err_out; - return fd; - -err_out: - dma_buf_put(dmabuf); + if (IS_ERR_VALUE(fd)) + dma_buf_put(dmabuf); return fd; } diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c index 850afd1ff437..3f7573a9ffcc 100644 --- a/drivers/video/tegra/nvmap/nvmap_ioctl.c +++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c @@ -3,7 +3,7 @@ * * User-space interface to nvmap * - * Copyright (c) 2011-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2011-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -88,6 +88,7 @@ int nvmap_ioctl_pinop(struct file *filp, bool is_pin, void __user *arg, return -EFAULT; op.handles = (__u32 *)(uintptr_t)op32.handles; op.count = op32.count; + op.addr = (unsigned long *)(uintptr_t)op32.addr; } else #endif if (copy_from_user(&op, arg, sizeof(op))) @@ -226,6 +227,33 @@ const struct file_operations nvmap_fd_fops = { .mmap = nvmap_share_mmap, }; +static int nvmap_install_fd(struct nvmap_client *client, + struct nvmap_handle *handle, int fd, void __user *arg, + void *op, size_t op_size, bool free) +{ + int err = 0; + + if (IS_ERR_VALUE(fd)) { + err = fd; + goto fd_fail; + } + + if (copy_to_user(arg, op, op_size)) { + err = -EFAULT; + goto copy_fail; + } + + fd_install(fd, handle->dmabuf->file); + return err; + +copy_fail: + put_unused_fd(fd); +fd_fail: + if (free) + nvmap_free_handle(client, handle); + return err; +} + int nvmap_ioctl_getfd(struct file *filp, void __user *arg) { struct nvmap_handle *handle; @@ -241,14 +269,9 @@ int nvmap_ioctl_getfd(struct file *filp, void __user *arg) op.fd = nvmap_get_dmabuf_fd(client, handle); nvmap_handle_put(handle); - if (op.fd < 0) - return op.fd; - if (copy_to_user(arg, &op, sizeof(op))) { - sys_close(op.fd); - return -EFAULT; - } - return 0; + return nvmap_install_fd(client, handle, + op.fd, arg, &op, sizeof(op), 0); } int nvmap_ioctl_alloc(struct file *filp, void __user *arg) @@ -309,30 +332,11 @@ int nvmap_ioctl_alloc_kind(struct file *filp, void __user *arg) return err; } -int nvmap_create_fd(struct nvmap_client *client, struct nvmap_handle *h) -{ - int fd; - - fd = __nvmap_dmabuf_fd(client, h->dmabuf, O_CLOEXEC); - BUG_ON(fd == 0); - if (fd < 0) { - pr_err("Out of file descriptors"); - return fd; - } - /* __nvmap_dmabuf_fd() associates fd with dma_buf->file *. - * fd close drops one ref count on dmabuf->file *. - * to balance ref count, ref count dma_buf. - */ - get_dma_buf(h->dmabuf); - return fd; -} - int nvmap_ioctl_create(struct file *filp, unsigned int cmd, void __user *arg) { struct nvmap_create_handle op; struct nvmap_handle_ref *ref = NULL; struct nvmap_client *client = filp->private_data; - int err = 0; int fd = 0; if (copy_from_user(&op, arg, sizeof(op))) @@ -354,20 +358,10 @@ int nvmap_ioctl_create(struct file *filp, unsigned int cmd, void __user *arg) if (IS_ERR(ref)) return PTR_ERR(ref); - fd = nvmap_create_fd(client, ref->handle); - if (fd < 0) - err = fd; - + fd = nvmap_get_dmabuf_fd(client, ref->handle); op.handle = fd; - - if (copy_to_user(arg, &op, sizeof(op))) { - err = -EFAULT; - nvmap_free_handle(client, __nvmap_ref_to_id(ref)); - } - - if (err && fd > 0) - sys_close(fd); - return err; + return nvmap_install_fd(client, ref->handle, fd, + arg, &op, sizeof(op), 1); } int nvmap_map_into_caller_ptr(struct file *filp, void __user *arg, bool is32) @@ -472,9 +466,9 @@ int nvmap_ioctl_get_param(struct file *filp, void __user *arg, bool is32) struct nvmap_handle_param __user *uarg = arg; struct nvmap_handle_param op; struct nvmap_client *client = filp->private_data; - struct nvmap_handle_ref *ref; - struct nvmap_handle *h; - u64 result; + struct nvmap_handle_ref *ref = NULL; + struct nvmap_handle *h = NULL; + u64 result = 0; int err = 0; #ifdef CONFIG_COMPAT @@ -500,6 +494,9 @@ int nvmap_ioctl_get_param(struct file *filp, void __user *arg, bool is32) } err = nvmap_get_handle_param(client, ref, op.param, &result); + if (err) { + goto ref_fail; + } #ifdef CONFIG_COMPAT if (is32) @@ -936,6 +933,11 @@ int __nvmap_do_cache_maint(struct nvmap_client *client, if (!h) return -EFAULT; + if ((start >= h->size) || (end > h->size)) { + nvmap_handle_put(h); + return -EFAULT; + } + if (op == NVMAP_CACHE_OP_INV) op = NVMAP_CACHE_OP_WB_INV; @@ -1088,7 +1090,7 @@ int nvmap_ioctl_cache_maint_list(struct file *filp, void __user *arg, if (copy_from_user(&op, arg, sizeof(op))) return -EFAULT; - if (!op.nr) + if (!op.nr || op.nr > UINT_MAX / sizeof(u32)) return -EINVAL; if (!access_ok(VERIFY_READ, op.handles, op.nr * sizeof(u32))) diff --git a/drivers/video/tegra/nvmap/nvmap_mm.c b/drivers/video/tegra/nvmap/nvmap_mm.c index 133f00b1aaa9..fbf510081be7 100644 --- a/drivers/video/tegra/nvmap/nvmap_mm.c +++ b/drivers/video/tegra/nvmap/nvmap_mm.c @@ -3,7 +3,7 @@ * * Some MM related functionality specific to nvmap. * - * Copyright (c) 2013-2014, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2013-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -193,6 +193,10 @@ void nvmap_zap_handle(struct nvmap_handle *handle, u32 offset, u32 size) size = PAGE_ALIGN((offset & ~PAGE_MASK) + size); + if ((offset >= handle->size) || (offset > handle->size - size) || + (size > handle->size)) + return; + mutex_lock(&handle->lock); vmas = &handle->vmas; list_for_each_entry(vma_list, vmas, list) { @@ -231,6 +235,15 @@ int nvmap_reserve_pages(struct nvmap_handle **handles, u32 *offsets, u32 *sizes, { int i; + /* validates all page params first */ + for (i = 0; i < nr; i++) { + u32 size = sizes[i] ? sizes[i] : handles[i]->size; + u32 offset = sizes[i] ? offsets[i] : 0; + + if ((offset != 0) || (size != handles[i]->size)) + return -EINVAL; + } + for (i = 0; i < nr; i++) { u32 size = sizes[i] ? sizes[i] : handles[i]->size; u32 offset = sizes[i] ? offsets[i] : 0; diff --git a/drivers/video/tegra/nvmap/nvmap_priv.h b/drivers/video/tegra/nvmap/nvmap_priv.h index a90a3269cd62..705745702abd 100644 --- a/drivers/video/tegra/nvmap/nvmap_priv.h +++ b/drivers/video/tegra/nvmap/nvmap_priv.h @@ -3,7 +3,7 @@ * * GPU memory management driver for Tegra * - * Copyright (c) 2009-2016, NVIDIA CORPORATION. All rights reserved. + * Copyright (c) 2009-2017, NVIDIA CORPORATION. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -467,10 +467,13 @@ static inline void nvmap_handle_mk(struct nvmap_handle *h, void (*fn)(struct page **)) { int i; - int start_page = PAGE_ALIGN(offset) >> PAGE_SHIFT; - int end_page = (offset + size) >> PAGE_SHIFT; + u32 start_page = offset >> PAGE_SHIFT; + u32 end_page = PAGE_ALIGN(offset + size) >> PAGE_SHIFT; - if (h->heap_pgalloc) { + if (h->heap_pgalloc && + (offset < h->size) && + (size <= h->size) && + (offset <= (h->size - size))) { for (i = start_page; i < end_page; i++) fn(&h->pgalloc.pages[i]); } |