525.60.11

kernel-open/nvidia/export_nvswitch.h

@@ -808,6 +808,14 @@ nvswitch_os_strncmp
     NvLength length
 );
 
+char*
+nvswitch_os_strncat
+(
+    char *s1,
+    const char *s2,
+    NvLength length
+);
+
 void *
 nvswitch_os_memset
 (

kernel-open/nvidia/linux_nvswitch.c

@@ -2393,6 +2393,17 @@ nvswitch_os_strncmp
     return strncmp(s1, s2, length);
 }
 
+char*
+nvswitch_os_strncat
+(
+    char *s1,
+    const char *s2,
+    NvLength length
+)
+{
+    return strncat(s1, s2, length);
+}
+
 void *
 nvswitch_os_memset
 (

kernel-open/nvidia/nv-dmabuf.c

@@ -857,7 +857,8 @@ nv_dma_buf_reuse(
         goto cleanup_dmabuf;
     }
 
-    if (params->index > (priv->total_objects - params->numObjects))
+    if ((priv->total_objects < params->numObjects) ||
+        (params->index > (priv->total_objects - params->numObjects)))
     {
         status = NV_ERR_INVALID_ARGUMENT;
         goto unlock_priv;

kernel-open/nvidia/nv-mmap.c

@@ -132,6 +132,11 @@ nvidia_vma_access(
     pageIndex = ((addr - vma->vm_start) >> PAGE_SHIFT);
     pageOffset = (addr & ~PAGE_MASK);
 
+    if (length < 0)
+    {
+        return -EINVAL;
+    }
+
     if (!mmap_context->valid)
     {
         nv_printf(NV_DBG_ERRORS, "NVRM: VM: invalid mmap context\n");
@@ -210,8 +215,12 @@ static vm_fault_t nvidia_fault(
 
     NvU64 page;
     NvU64 num_pages = NV_VMA_SIZE(vma) >> PAGE_SHIFT;
-    NvU64 pfn_start =
-        (nvlfp->mmap_context.mmap_start >> PAGE_SHIFT) + vma->vm_pgoff;
+    NvU64 pfn_start = (nvlfp->mmap_context.mmap_start >> PAGE_SHIFT);
+
+    if (vma->vm_pgoff != 0)
+    {
+        return VM_FAULT_SIGBUS;
+    }
 
     // Mapping revocation is only supported for GPU mappings.
     if (NV_IS_CTL_DEVICE(nv))
@@ -484,6 +493,11 @@ int nvidia_mmap_helper(
         return -EINVAL;
     }
 
+    if (vma->vm_pgoff != 0)
+    {
+        return -EINVAL;
+    }
+
     NV_PRINT_VMA(NV_DBG_MEMINFO, vma);
 
     status = nv_check_gpu_state(nv);
@@ -510,6 +524,11 @@ int nvidia_mmap_helper(
         NvU64 access_start = mmap_context->access_start;
         NvU64 access_len = mmap_context->access_size;
 
+        // validate the size
+        if (NV_VMA_SIZE(vma) != mmap_length)
+        {
+            return -ENXIO;
+        }
         if (IS_REG_OFFSET(nv, access_start, access_len))
         {
             if (nv_encode_caching(&vma->vm_page_prot, NV_MEMORY_UNCACHED,

kernel-open/nvidia/nv.c

@@ -1432,6 +1432,9 @@ static int nv_open_device(nv_state_t *nv, nvidia_stack_t *sp)
         return -ENODEV;
     }
 
+    if (unlikely(NV_ATOMIC_READ(nvl->usage_count) >= NV_S32_MAX))
+        return -EMFILE;
+
     if ( ! (nv->flags & NV_FLAG_OPEN))
     {
         /* Sanity check: !NV_FLAG_OPEN requires usage_count == 0 */

kernel-open/nvidia/nvlink_linux.c

@@ -207,6 +207,9 @@ static int nvlink_fops_release(struct inode *inode, struct file *filp)
 
     nvlink_print(NVLINK_DBG_INFO, "nvlink driver close\n");
 
+    if (private == NULL)
+        return -ENOMEM;
+
     mutex_lock(&nvlink_drvctx.lock);
 
     if (private->capability_fds.fabric_mgmt > 0)

kernel-open/nvidia/os-interface.c

@@ -1224,11 +1224,27 @@ void NV_API_CALL os_get_screen_info(
                 *pFbHeight = registered_fb[i]->var.yres;
                 *pFbDepth = registered_fb[i]->var.bits_per_pixel;
                 *pFbPitch = registered_fb[i]->fix.line_length;
-                break;
+                return;
             }
         }
     }
-#elif NV_IS_EXPORT_SYMBOL_PRESENT_screen_info
+#endif
+
+    /*
+     * If the screen info is not found in the registered FBs then fallback
+     * to the screen_info structure.
+     *
+     * The SYSFB_SIMPLEFB option, if enabled, marks VGA/VBE/EFI framebuffers as
+     * generic framebuffers so the new generic system-framebuffer drivers can
+     * be used instead. DRM_SIMPLEDRM drives the generic system-framebuffers
+     * device created by SYSFB_SIMPLEFB.
+     *
+     * SYSFB_SIMPLEFB registers a dummy framebuffer which does not contain the
+     * information required by os_get_screen_info(), therefore you need to
+     * fall back onto the screen_info structure.
+     */
+
+#if NV_IS_EXPORT_SYMBOL_PRESENT_screen_info
     /*
      * If there is not a framebuffer console, return 0 size.
      *