From aa52019b1b10988afaf210abbf321d41b7803804 Mon Sep 17 00:00:00 2001 From: Terje Bergstrom Date: Fri, 1 Jun 2012 11:09:36 +0300 Subject: video: tegra: host: Remove error case panics Remove BUG_ON()s in error cases: * If IOCTL size is too large, return error instead * If sync point id is out of range, return error. Prevents panics in sanity checks nvhost_cdma. Bug 993642 Change-Id: I3cfa7a23dc557c811e20b726885f82666437de7f Signed-off-by: Terje Bergstrom Reviewed-on: http://git-master/r/105866 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Juha Tukkinen --- drivers/video/tegra/host/dev.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'drivers/video/tegra/host/dev.c') diff --git a/drivers/video/tegra/host/dev.c b/drivers/video/tegra/host/dev.c index 67520a884d3e..2c05fbfb7477 100644 --- a/drivers/video/tegra/host/dev.c +++ b/drivers/video/tegra/host/dev.c @@ -255,11 +255,10 @@ static long nvhost_ctrlctl(struct file *filp, if ((_IOC_TYPE(cmd) != NVHOST_IOCTL_MAGIC) || (_IOC_NR(cmd) == 0) || - (_IOC_NR(cmd) > NVHOST_IOCTL_CTRL_LAST)) + (_IOC_NR(cmd) > NVHOST_IOCTL_CTRL_LAST) || + (_IOC_SIZE(cmd) > NVHOST_IOCTL_CTRL_MAX_ARG_SIZE)) return -EFAULT; - BUG_ON(_IOC_SIZE(cmd) > NVHOST_IOCTL_CTRL_MAX_ARG_SIZE); - if (_IOC_DIR(cmd) & _IOC_WRITE) { if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) return -EFAULT; -- cgit v1.2.3