lkml.org 
[lkml]   [2021]   [Sep]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 55/63] habanalabs: add validity check for event ID received from F/W
    Date
    From: Ofir Bitton <obitton@habana.ai>

    [ Upstream commit a6c849012b0f51c674f52384bd9a4f3dc0a33c31 ]

    Currently there is no validity check for event ID received from F/W,
    Thus exposing driver to memory overrun.

    Signed-off-by: Ofir Bitton <obitton@habana.ai>
    Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
    Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/misc/habanalabs/gaudi/gaudi.c | 6 ++++++
    drivers/misc/habanalabs/goya/goya.c | 6 ++++++
    2 files changed, 12 insertions(+)

    diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
    index 37edd663603f..ebac53a73bd1 100644
    --- a/drivers/misc/habanalabs/gaudi/gaudi.c
    +++ b/drivers/misc/habanalabs/gaudi/gaudi.c
    @@ -5723,6 +5723,12 @@ static void gaudi_handle_eqe(struct hl_device *hdev,
    u8 cause;
    bool reset_required;

    + if (event_type >= GAUDI_EVENT_SIZE) {
    + dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
    + event_type, GAUDI_EVENT_SIZE - 1);
    + return;
    + }
    +
    gaudi->events_stat[event_type]++;
    gaudi->events_stat_aggregate[event_type]++;

    diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
    index 5b5d6275c249..c8023b4428c5 100644
    --- a/drivers/misc/habanalabs/goya/goya.c
    +++ b/drivers/misc/habanalabs/goya/goya.c
    @@ -4623,6 +4623,12 @@ void goya_handle_eqe(struct hl_device *hdev, struct hl_eq_entry *eq_entry)
    >> EQ_CTL_EVENT_TYPE_SHIFT);
    struct goya_device *goya = hdev->asic_specific;

    + if (event_type >= GOYA_ASYNC_EVENT_ID_SIZE) {
    + dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
    + event_type, GOYA_ASYNC_EVENT_ID_SIZE - 1);
    + return;
    + }
    +
    goya->events_stat[event_type]++;
    goya->events_stat_aggregate[event_type]++;

    --
    2.33.0


    \
     
     \ /
      Last update: 2021-09-24 15:14    [W:4.854 / U:0.916 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site