525.60.11

kernel-open/Kbuild

@@ -72,7 +72,7 @@ EXTRA_CFLAGS += -I$(src)/common/inc
 EXTRA_CFLAGS += -I$(src)
 EXTRA_CFLAGS += -Wall -MD $(DEFINES) $(INCLUDES) -Wno-cast-qual -Wno-error -Wno-format-extra-args
 EXTRA_CFLAGS += -D__KERNEL__ -DMODULE -DNVRM
-EXTRA_CFLAGS += -DNV_VERSION_STRING=\"525.53\"
+EXTRA_CFLAGS += -DNV_VERSION_STRING=\"525.60.11\"
 
 EXTRA_CFLAGS += -Wno-unused-function
 

kernel-open/common/inc/nv.h

@@ -643,12 +643,14 @@ typedef enum {
 static inline NvBool IS_REG_OFFSET(nv_state_t *nv, NvU64 offset, NvU64 length)
 {
     return ((offset >= nv->regs->cpu_address) &&
+            ((offset + (length - 1)) >= offset) &&
             ((offset + (length - 1)) <= (nv->regs->cpu_address + (nv->regs->size - 1))));
 }
 
 static inline NvBool IS_FB_OFFSET(nv_state_t *nv, NvU64 offset, NvU64 length)
 {
     return  ((nv->fb) && (offset >= nv->fb->cpu_address) &&
+             ((offset + (length - 1)) >= offset) &&
              ((offset + (length - 1)) <= (nv->fb->cpu_address + (nv->fb->size - 1))));
 }
 
@@ -656,6 +658,7 @@ static inline NvBool IS_UD_OFFSET(nv_state_t *nv, NvU64 offset, NvU64 length)
 {
     return ((nv->ud.cpu_address != 0) && (nv->ud.size != 0) &&
             (offset >= nv->ud.cpu_address) &&
+            ((offset + (length - 1)) >= offset) &&
             ((offset + (length - 1)) <= (nv->ud.cpu_address + (nv->ud.size - 1))));
 }
 
@@ -664,6 +667,7 @@ static inline NvBool IS_IMEM_OFFSET(nv_state_t *nv, NvU64 offset, NvU64 length)
     return ((nv->bars[NV_GPU_BAR_INDEX_IMEM].cpu_address != 0) &&
             (nv->bars[NV_GPU_BAR_INDEX_IMEM].size != 0) &&
             (offset >= nv->bars[NV_GPU_BAR_INDEX_IMEM].cpu_address) &&
+            ((offset + (length - 1)) >= offset) &&
             ((offset + (length - 1)) <= (nv->bars[NV_GPU_BAR_INDEX_IMEM].cpu_address +
                                          (nv->bars[NV_GPU_BAR_INDEX_IMEM].size - 1))));
 }

kernel-open/common/inc/nv_uvm_interface.h

@@ -1364,8 +1364,6 @@ void nvUvmInterfacePagingChannelsUnmap(uvmGpuAddressSpaceHandle srcVaSpace,
           a. pre-allocated stack
           b. the fact that internal RPC infrastructure doesn't acquire GPU lock.
         Therefore, locking is the caller's responsibility.
-      - This function DOES NOT sleep (does not allocate memory or acquire locks)
-        so it can be invoked while holding a spinlock.
 
     Arguments:
         channel[IN]          - paging channel handle obtained via

kernel-open/common/inc/nv_uvm_types.h

@@ -830,6 +830,8 @@ typedef struct UvmGpuFaultInfo_tag
     NvHandle faultBufferHandle;
 } UvmGpuFaultInfo;
 
+struct Device;
+
 typedef struct UvmGpuPagingChannel_tag
 {
     struct gpuDevice  *device;
@@ -837,6 +839,7 @@ typedef struct UvmGpuPagingChannel_tag
     NvHandle          channelHandle;
     NvHandle          errorNotifierHandle;
     void              *pushStreamSp;
+    struct Device     *pDevice;
 } UvmGpuPagingChannel, *UvmGpuPagingChannelHandle;
 
 typedef struct UvmGpuAccessCntrInfo_tag

kernel-open/nvidia-drm/nvidia-drm-gem-nvkms-memory.c

@@ -95,7 +95,7 @@ static vm_fault_t __nv_drm_gem_nvkms_handle_vma_fault(
         pfn >>= PAGE_SHIFT;
         pfn += page_offset;
     } else {
-        BUG_ON(page_offset > nv_nvkms_memory->pages_count);
+        BUG_ON(page_offset >= nv_nvkms_memory->pages_count);
         pfn = page_to_pfn(nv_nvkms_memory->pages[page_offset]);
     }
 

kernel-open/nvidia-drm/nvidia-drm-gem-user-memory.c

@@ -112,7 +112,7 @@ static vm_fault_t __nv_drm_gem_user_memory_handle_vma_fault(
 
     page_offset = vmf->pgoff - drm_vma_node_start(&gem->vma_node);
 
-    BUG_ON(page_offset > nv_user_memory->pages_count);
+    BUG_ON(page_offset >= nv_user_memory->pages_count);
     ret = vm_insert_page(vma, address, nv_user_memory->pages[page_offset]);
     switch (ret) {
         case 0:

kernel-open/nvidia-drm/nvidia-drm-linux.c

@@ -47,6 +47,14 @@ module_param_named(modeset, nv_drm_modeset_module_param, bool, 0400);
 
 void *nv_drm_calloc(size_t nmemb, size_t size)
 {
+    size_t total_size = nmemb * size;
+    //
+    // Check for overflow.
+    //
+    if ((nmemb != 0) && ((total_size / nmemb) != size))
+    {
+        return NULL;
+    }
     return kzalloc(nmemb * size, GFP_KERNEL);
 }
 

kernel-open/nvidia-modeset/nvidia-modeset-linux.c

@@ -34,6 +34,7 @@
 #include <linux/file.h>
 #include <linux/list.h>
 #include <linux/rwsem.h>
+#include <linux/freezer.h>
 
 #include <acpi/video.h>
 
@@ -182,7 +183,10 @@ static inline int nvkms_read_trylock_pm_lock(void)
 
 static inline void nvkms_read_lock_pm_lock(void)
 {
-    down_read(&nvkms_pm_lock);
+    while (!down_read_trylock(&nvkms_pm_lock)) {
+        try_to_freeze();
+        cond_resched();
+    }
 }
 
 static inline void nvkms_read_unlock_pm_lock(void)
@@ -1086,7 +1090,7 @@ failed:
     return NULL;
 }
 
-void nvkms_close_common(struct nvkms_per_open *popen)
+void nvkms_close_pm_locked(struct nvkms_per_open *popen)
 {
     /*
      * Don't use down_interruptible(): we need to free resources
@@ -1124,13 +1128,13 @@ void nvkms_close_common(struct nvkms_per_open *popen)
     nvkms_free(popen, sizeof(*popen));
 }
 
-static void nvkms_close_deferred(void *data)
+static void nvkms_close_pm_unlocked(void *data)
 {
     struct nvkms_per_open *popen = data;
 
     nvkms_read_lock_pm_lock();
 
-    nvkms_close_common(popen);
+    nvkms_close_pm_locked(popen);
 
     nvkms_read_unlock_pm_lock();
 }
@@ -1138,11 +1142,11 @@ static void nvkms_close_deferred(void *data)
 static void nvkms_close_popen(struct nvkms_per_open *popen)
 {
     if (nvkms_read_trylock_pm_lock() == 0) {
-        nvkms_close_common(popen);
+        nvkms_close_pm_locked(popen);
         nvkms_read_unlock_pm_lock();
     } else {
         nv_kthread_q_item_init(&popen->deferred_close_q_item,
-                               nvkms_close_deferred,
+                               nvkms_close_pm_unlocked,
                                popen);
         nvkms_queue_work(&nvkms_deferred_close_kthread_q,
                          &popen->deferred_close_q_item);
@@ -1195,7 +1199,7 @@ struct nvkms_per_open* nvkms_open_from_kapi
 
 void nvkms_close_from_kapi(struct nvkms_per_open *popen)
 {
-    nvkms_close_popen(popen);
+    nvkms_close_pm_unlocked(popen);
 }
 
 NvBool nvkms_ioctl_from_kapi

kernel-open/nvidia-uvm/uvm_va_block.c

@@ -3382,7 +3382,7 @@ NV_STATUS uvm_va_block_make_resident_read_duplicate(uvm_va_block_t *va_block,
 
     // TODO: Bug 3660922: need to implement HMM read duplication support.
     UVM_ASSERT(!uvm_va_block_is_hmm(va_block));
-    UVM_ASSERT(va_block_context->policy = uvm_va_range_get_policy(va_block->va_range));
+    UVM_ASSERT(va_block_context->policy == uvm_va_range_get_policy(va_block->va_range));
 
     va_block_context->make_resident.dest_id = dest_id;
     va_block_context->make_resident.cause = cause;

kernel-open/nvidia/export_nvswitch.h

@@ -808,6 +808,14 @@ nvswitch_os_strncmp
     NvLength length
 );
 
+char*
+nvswitch_os_strncat
+(
+    char *s1,
+    const char *s2,
+    NvLength length
+);
+
 void *
 nvswitch_os_memset
 (

kernel-open/nvidia/linux_nvswitch.c

@@ -2393,6 +2393,17 @@ nvswitch_os_strncmp
     return strncmp(s1, s2, length);
 }
 
+char*
+nvswitch_os_strncat
+(
+    char *s1,
+    const char *s2,
+    NvLength length
+)
+{
+    return strncat(s1, s2, length);
+}
+
 void *
 nvswitch_os_memset
 (

kernel-open/nvidia/nv-dmabuf.c

@@ -857,7 +857,8 @@ nv_dma_buf_reuse(
         goto cleanup_dmabuf;
     }
 
-    if (params->index > (priv->total_objects - params->numObjects))
+    if ((priv->total_objects < params->numObjects) ||
+        (params->index > (priv->total_objects - params->numObjects)))
     {
         status = NV_ERR_INVALID_ARGUMENT;
         goto unlock_priv;

kernel-open/nvidia/nv-mmap.c

@@ -132,6 +132,11 @@ nvidia_vma_access(
     pageIndex = ((addr - vma->vm_start) >> PAGE_SHIFT);
     pageOffset = (addr & ~PAGE_MASK);
 
+    if (length < 0)
+    {
+        return -EINVAL;
+    }
+
     if (!mmap_context->valid)
     {
         nv_printf(NV_DBG_ERRORS, "NVRM: VM: invalid mmap context\n");
@@ -210,8 +215,12 @@ static vm_fault_t nvidia_fault(
 
     NvU64 page;
     NvU64 num_pages = NV_VMA_SIZE(vma) >> PAGE_SHIFT;
-    NvU64 pfn_start =
-        (nvlfp->mmap_context.mmap_start >> PAGE_SHIFT) + vma->vm_pgoff;
+    NvU64 pfn_start = (nvlfp->mmap_context.mmap_start >> PAGE_SHIFT);
+
+    if (vma->vm_pgoff != 0)
+    {
+        return VM_FAULT_SIGBUS;
+    }
 
     // Mapping revocation is only supported for GPU mappings.
     if (NV_IS_CTL_DEVICE(nv))
@@ -484,6 +493,11 @@ int nvidia_mmap_helper(
         return -EINVAL;
     }
 
+    if (vma->vm_pgoff != 0)
+    {
+        return -EINVAL;
+    }
+
     NV_PRINT_VMA(NV_DBG_MEMINFO, vma);
 
     status = nv_check_gpu_state(nv);
@@ -510,6 +524,11 @@ int nvidia_mmap_helper(
         NvU64 access_start = mmap_context->access_start;
         NvU64 access_len = mmap_context->access_size;
 
+        // validate the size
+        if (NV_VMA_SIZE(vma) != mmap_length)
+        {
+            return -ENXIO;
+        }
         if (IS_REG_OFFSET(nv, access_start, access_len))
         {
             if (nv_encode_caching(&vma->vm_page_prot, NV_MEMORY_UNCACHED,

kernel-open/nvidia/nv.c

@@ -1432,6 +1432,9 @@ static int nv_open_device(nv_state_t *nv, nvidia_stack_t *sp)
         return -ENODEV;
     }
 
+    if (unlikely(NV_ATOMIC_READ(nvl->usage_count) >= NV_S32_MAX))
+        return -EMFILE;
+
     if ( ! (nv->flags & NV_FLAG_OPEN))
     {
         /* Sanity check: !NV_FLAG_OPEN requires usage_count == 0 */

kernel-open/nvidia/nvlink_linux.c

@@ -207,6 +207,9 @@ static int nvlink_fops_release(struct inode *inode, struct file *filp)
 
     nvlink_print(NVLINK_DBG_INFO, "nvlink driver close\n");
 
+    if (private == NULL)
+        return -ENOMEM;
+
     mutex_lock(&nvlink_drvctx.lock);
 
     if (private->capability_fds.fabric_mgmt > 0)

kernel-open/nvidia/os-interface.c

@@ -1224,11 +1224,27 @@ void NV_API_CALL os_get_screen_info(
                 *pFbHeight = registered_fb[i]->var.yres;
                 *pFbDepth = registered_fb[i]->var.bits_per_pixel;
                 *pFbPitch = registered_fb[i]->fix.line_length;
-                break;
+                return;
             }
         }
     }
-#elif NV_IS_EXPORT_SYMBOL_PRESENT_screen_info
+#endif
+
+    /*
+     * If the screen info is not found in the registered FBs then fallback
+     * to the screen_info structure.
+     *
+     * The SYSFB_SIMPLEFB option, if enabled, marks VGA/VBE/EFI framebuffers as
+     * generic framebuffers so the new generic system-framebuffer drivers can
+     * be used instead. DRM_SIMPLEDRM drives the generic system-framebuffers
+     * device created by SYSFB_SIMPLEFB.
+     *
+     * SYSFB_SIMPLEFB registers a dummy framebuffer which does not contain the
+     * information required by os_get_screen_info(), therefore you need to
+     * fall back onto the screen_info structure.
+     */
+
+#if NV_IS_EXPORT_SYMBOL_PRESENT_screen_info
     /*
      * If there is not a framebuffer console, return 0 size.
      *