From 23af0fccf550796124a3ef77c7ab22469f3bc3a9 Mon Sep 17 00:00:00 2001 From: Yu Qiaowei Date: Fri, 7 Apr 2023 15:17:23 +0800 Subject: [PATCH] video: rockchip: rga3: prevent pages order out of bounds Signed-off-by: Yu Qiaowei Change-Id: I6ed55d2d7180ae1ba928ca1f8399d4c8eb312e18 --- drivers/video/rockchip/rga3/rga_iommu.c | 12 ++++++++++++ drivers/video/rockchip/rga3/rga_mm.c | 24 +++++++++++++++++++++--- 2 files changed, 33 insertions(+), 3 deletions(-) diff --git a/drivers/video/rockchip/rga3/rga_iommu.c b/drivers/video/rockchip/rga3/rga_iommu.c index f4fb84aec604..6ef9cbc0d5d2 100644 --- a/drivers/video/rockchip/rga3/rga_iommu.c +++ b/drivers/video/rockchip/rga3/rga_iommu.c @@ -170,6 +170,12 @@ struct rga_mmu_base *rga_mmu_base_init(size_t size) * size * channel_num * address_size */ order = get_order(size * 3 * sizeof(*mmu_base->buf_virtual)); + if (order >= MAX_ORDER) { + pr_err("Can not alloc pages with order[%d] for mmu_page_table, max_order = %d\n", + order, MAX_ORDER); + goto err_free_mmu_base; + } + mmu_base->buf_virtual = (uint32_t *) __get_free_pages(GFP_KERNEL | GFP_DMA32, order); if (mmu_base->buf_virtual == NULL) { pr_err("Can not alloc pages for mmu_page_table\n"); @@ -178,6 +184,12 @@ struct rga_mmu_base *rga_mmu_base_init(size_t size) mmu_base->buf_order = order; order = get_order(size * sizeof(*mmu_base->pages)); + if (order >= MAX_ORDER) { + pr_err("Can not alloc pages with order[%d] for mmu_base->pages, max_order = %d\n", + order, MAX_ORDER); + goto err_free_buf_virtual; + } + mmu_base->pages = (struct page **)__get_free_pages(GFP_KERNEL | GFP_DMA32, order); if (mmu_base->pages == NULL) { pr_err("Can not alloc pages for mmu_base->pages\n"); diff --git a/drivers/video/rockchip/rga3/rga_mm.c b/drivers/video/rockchip/rga3/rga_mm.c index 59a21c4e4c45..cd461b57ff7e 100644 --- a/drivers/video/rockchip/rga3/rga_mm.c +++ b/drivers/video/rockchip/rga3/rga_mm.c @@ -258,9 +258,15 @@ static int rga_alloc_virt_addr(struct rga_virt_addr **virt_addr_p, /* alloc pages and page_table */ order = get_order(count * sizeof(struct page *)); + if (order >= MAX_ORDER) { + pr_err("Can not alloc pages with order[%d] for viraddr pages, max_order = %d\n", + order, MAX_ORDER); + return -ENOMEM; + } + pages = (struct page **)__get_free_pages(GFP_KERNEL, order); if (pages == NULL) { - pr_err("%s can not alloc pages for pages\n", __func__); + pr_err("%s can not alloc pages for viraddr pages\n", __func__); return -ENOMEM; } @@ -1168,9 +1174,15 @@ static int rga_mm_set_mmu_base(struct rga_job *job, if (job->flags & RGA_JOB_USE_HANDLE) { order = get_order(page_count * sizeof(uint32_t *)); + if (order >= MAX_ORDER) { + pr_err("Can not alloc pages with order[%d] for page_table, max_order = %d\n", + order, MAX_ORDER); + return -ENOMEM; + } + page_table = (uint32_t *)__get_free_pages(GFP_KERNEL | GFP_DMA32, order); if (page_table == NULL) { - pr_err("%s can not alloc pages for pages, order = %d\n", + pr_err("%s can not alloc pages for page_table, order = %d\n", __func__, order); return -ENOMEM; } @@ -1227,9 +1239,15 @@ static int rga_mm_set_mmu_base(struct rga_job *job, if (job->flags & RGA_JOB_USE_HANDLE) { order = get_order(page_count * sizeof(uint32_t *)); + if (order >= MAX_ORDER) { + pr_err("Can not alloc pages with order[%d] for page_table, max_order = %d\n", + order, MAX_ORDER); + return -ENOMEM; + } + page_table = (uint32_t *)__get_free_pages(GFP_KERNEL | GFP_DMA32, order); if (page_table == NULL) { - pr_err("%s can not alloc pages for pages, order = %d\n", + pr_err("%s can not alloc pages for page_table, order = %d\n", __func__, order); return -ENOMEM; }