diff options
| author | Terje Bergstrom <tbergstrom@nvidia.com> | 2012-06-01 11:09:36 +0300 |
|---|---|---|
| committer | Simone Willett <swillett@nvidia.com> | 2012-06-04 14:20:53 -0700 |
| commit | aa52019b1b10988afaf210abbf321d41b7803804 (patch) | |
| tree | d7733992cbc20c0b7057946d6feaad8d0c73a70b /drivers/video/tegra/host/bus_client.c | |
| parent | 4f569435116d03ae59e3acbfed7bdcc75ca88945 (diff) | |
video: tegra: host: Remove error case panics
Remove BUG_ON()s in error cases:
* If IOCTL size is too large, return error instead
* If sync point id is out of range, return error. Prevents panics in
sanity checks nvhost_cdma.
Bug 993642
Change-Id: I3cfa7a23dc557c811e20b726885f82666437de7f
Signed-off-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-on: http://git-master/r/105866
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Juha Tukkinen <jtukkinen@nvidia.com>
Diffstat (limited to 'drivers/video/tegra/host/bus_client.c')
| -rw-r--r-- | drivers/video/tegra/host/bus_client.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/drivers/video/tegra/host/bus_client.c b/drivers/video/tegra/host/bus_client.c index 651a8dec738c..6bfce9a3cb2a 100644 --- a/drivers/video/tegra/host/bus_client.c +++ b/drivers/video/tegra/host/bus_client.c @@ -179,14 +179,17 @@ fail: static int set_submit(struct nvhost_channel_userctx *ctx) { - struct device *device = &ctx->ch->dev->dev; + struct nvhost_device *ndev = ctx->ch->dev; + struct nvhost_master *host = nvhost_get_host(ndev); /* submit should have at least 1 cmdbuf */ - if (!ctx->hdr.num_cmdbufs) + if (!ctx->hdr.num_cmdbufs || + !nvhost_syncpt_is_valid(&host->syncpt, + ctx->hdr.syncpt_id)) return -EIO; if (!ctx->nvmap) { - dev_err(device, "no nvmap context set\n"); + dev_err(&ndev->dev, "no nvmap context set\n"); return -EFAULT; } @@ -402,11 +405,10 @@ static long nvhost_channelctl(struct file *filp, if ((_IOC_TYPE(cmd) != NVHOST_IOCTL_MAGIC) || (_IOC_NR(cmd) == 0) || - (_IOC_NR(cmd) > NVHOST_IOCTL_CHANNEL_LAST)) + (_IOC_NR(cmd) > NVHOST_IOCTL_CHANNEL_LAST) || + (_IOC_SIZE(cmd) > NVHOST_IOCTL_CHANNEL_MAX_ARG_SIZE)) return -EFAULT; - BUG_ON(_IOC_SIZE(cmd) > NVHOST_IOCTL_CHANNEL_MAX_ARG_SIZE); - if (_IOC_DIR(cmd) & _IOC_WRITE) { if (copy_from_user(buf, (void __user *)arg, _IOC_SIZE(cmd))) return -EFAULT; |