lkml.org 
[lkml]   [2020]   [Sep]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.8 098/255] habanalabs: Fix memory corruption in debugfs
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit eeec23cd325ad4d83927b8ee162693579cf3813f ]

    This has to be a long instead of a u32 because we write a long value.
    On 64 bit systems, this will cause memory corruption.

    Fixes: c216477363a3 ("habanalabs: add debugfs support")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
    Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/misc/habanalabs/debugfs.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    diff --git a/drivers/misc/habanalabs/debugfs.c b/drivers/misc/habanalabs/debugfs.c
    index 0bc036e01ee8d..6c2b9cf45e831 100644
    --- a/drivers/misc/habanalabs/debugfs.c
    +++ b/drivers/misc/habanalabs/debugfs.c
    @@ -19,7 +19,7 @@
    static struct dentry *hl_debug_root;

    static int hl_debugfs_i2c_read(struct hl_device *hdev, u8 i2c_bus, u8 i2c_addr,
    - u8 i2c_reg, u32 *val)
    + u8 i2c_reg, long *val)
    {
    struct armcp_packet pkt;
    int rc;
    @@ -36,7 +36,7 @@ static int hl_debugfs_i2c_read(struct hl_device *hdev, u8 i2c_bus, u8 i2c_addr,
    pkt.i2c_reg = i2c_reg;

    rc = hdev->asic_funcs->send_cpu_message(hdev, (u32 *) &pkt, sizeof(pkt),
    - 0, (long *) val);
    + 0, val);

    if (rc)
    dev_err(hdev->dev, "Failed to read from I2C, error %d\n", rc);
    @@ -827,7 +827,7 @@ static ssize_t hl_i2c_data_read(struct file *f, char __user *buf,
    struct hl_dbg_device_entry *entry = file_inode(f)->i_private;
    struct hl_device *hdev = entry->hdev;
    char tmp_buf[32];
    - u32 val;
    + long val;
    ssize_t rc;

    if (*ppos)
    @@ -842,7 +842,7 @@ static ssize_t hl_i2c_data_read(struct file *f, char __user *buf,
    return rc;
    }

    - sprintf(tmp_buf, "0x%02x\n", val);
    + sprintf(tmp_buf, "0x%02lx\n", val);
    rc = simple_read_from_buffer(buf, count, ppos, tmp_buf,
    strlen(tmp_buf));

    --
    2.25.1


    \
     
     \ /
      Last update: 2020-09-01 18:08    [W:4.044 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site