diff options
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/tegra/host/bus_client.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/drivers/video/tegra/host/bus_client.c b/drivers/video/tegra/host/bus_client.c index 2bf11ed426c0..fb37a9e06ab3 100644 --- a/drivers/video/tegra/host/bus_client.c +++ b/drivers/video/tegra/host/bus_client.c @@ -402,6 +402,9 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, if (num_syncpt_incrs > host->info.nb_pts) return -EINVAL; + if (num_cmdbufs < 0 || num_syncpt_incrs < 0) + return -EINVAL; + job = nvhost_job_alloc(ctx->ch, ctx->hwctx, num_cmdbufs, @@ -580,7 +583,15 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, * syncpoint is used. */ if (args->flags & BIT(NVHOST_SUBMIT_FLAG_SYNC_FENCE_FD)) { - struct nvhost_ctrl_sync_fence_info pts[num_syncpt_incrs]; + struct nvhost_ctrl_sync_fence_info *pts; + + pts = kzalloc(num_syncpt_incrs * + sizeof(struct nvhost_ctrl_sync_fence_info), + GFP_KERNEL); + if (!pts) { + err = -ENOMEM; + goto fail; + } for (i = 0; i < num_syncpt_incrs; i++) { pts[i].id = job->sp[i].id; @@ -589,6 +600,7 @@ static int nvhost_ioctl_channel_submit(struct nvhost_channel_userctx *ctx, err = nvhost_sync_create_fence_fd(ctx->ch->dev, pts, num_syncpt_incrs, "fence", &args->fence); + kfree(pts); if (err) goto fail; } else if (num_syncpt_incrs == 1) |