62 lines
2.0 KiB
Diff
Raw Normal View History

2017-11-25 19:39:02 -05:00
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gm20b.c b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gm20b.c
index 1dcaba4..e08cf95 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gm20b.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/clk/gm20b.c
@@ -1613,6 +1613,9 @@
int tstate, throt_cur_tstate, edp_cur_tstate;
unsigned long freq, cur_freq = ULONG_MAX;
+ if (cur_state > bthrot_ins->throt_tab_size)
+ return -EINVAL;
+
if (bthrot_ins->cur_state == cur_state)
return 0;
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk20a.c b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk20a.c
index a18e4c9..1243d21 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk20a.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/volt/gk20a.c
@@ -314,6 +314,9 @@
struct gk20a_volt_priv *priv = (struct gk20a_volt_priv *)cdev->devdata;
struct nvkm_volt *volt = &priv->base;
+ if (cur_state >= MAX_THERMAL_LIMITS)
+ return -EINVAL;
+
mutex_lock(&volt->therm_lock);
if (priv->therm_idx == cur_state)
diff --git a/drivers/soc/tegra/tegra-dvfs.c b/drivers/soc/tegra/tegra-dvfs.c
index 5c0af3b..990cd61 100644
--- a/drivers/soc/tegra/tegra-dvfs.c
+++ b/drivers/soc/tegra/tegra-dvfs.c
@@ -1068,6 +1068,14 @@
if (IS_ERR_OR_NULL(tegra_core_rail) || !tegra_core_rail->is_ready)
return -EINVAL;
+ if (type == TEGRA_DVFS_CORE_THERMAL_FLOOR) {
+ if (new_idx >= rail->therm_floors_size)
+ return -EINVAL;
+ } else if (type == TEGRA_DVFS_CORE_THERMAL_CAP) {
+ if (new_idx > rail->therm_caps_size)
+ return -EINVAL;
+ }
+
mutex_lock(&dvfs_lock);
if (type == TEGRA_DVFS_CORE_THERMAL_FLOOR) {
if (rail->therm_floor_idx != new_idx) {
diff --git a/drivers/thermal/tegra/tegra_throttle.c b/drivers/thermal/tegra/tegra_throttle.c
index 39a913e..e9991db 100644
--- a/drivers/thermal/tegra/tegra_throttle.c
+++ b/drivers/thermal/tegra/tegra_throttle.c
@@ -198,6 +198,9 @@
if (bthrot->cpu_freq_table == NULL)
return 0;
+ if (cur_state > bthrot_ins->throt_tab_size)
+ return -EINVAL;
+
if (bthrot_ins->cur_state == cur_state)
return 0;