| From 52c44b4dafdda019c8734bc9d214db0d0e8c5ebb Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 20 Jul 2021 09:16:05 +0300 |
| Subject: habanalabs: add validity check for event ID received from F/W |
| |
| From: Ofir Bitton <obitton@habana.ai> |
| |
| [ Upstream commit a6c849012b0f51c674f52384bd9a4f3dc0a33c31 ] |
| |
| Currently there is no validity check for event ID received from F/W, |
| Thus exposing driver to memory overrun. |
| |
| Signed-off-by: Ofir Bitton <obitton@habana.ai> |
| Reviewed-by: Oded Gabbay <ogabbay@kernel.org> |
| Signed-off-by: Oded Gabbay <ogabbay@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/misc/habanalabs/gaudi/gaudi.c | 6 ++++++ |
| drivers/misc/habanalabs/goya/goya.c | 6 ++++++ |
| 2 files changed, 12 insertions(+) |
| |
| diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c |
| index aa8a0ca5aca2..409f05c962f2 100644 |
| --- a/drivers/misc/habanalabs/gaudi/gaudi.c |
| +++ b/drivers/misc/habanalabs/gaudi/gaudi.c |
| @@ -7809,6 +7809,12 @@ static void gaudi_handle_eqe(struct hl_device *hdev, |
| u8 cause; |
| bool reset_required; |
| |
| + if (event_type >= GAUDI_EVENT_SIZE) { |
| + dev_err(hdev->dev, "Event type %u exceeds maximum of %u", |
| + event_type, GAUDI_EVENT_SIZE - 1); |
| + return; |
| + } |
| + |
| gaudi->events_stat[event_type]++; |
| gaudi->events_stat_aggregate[event_type]++; |
| |
| diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c |
| index 755e08cf2ecc..bfb22f96c1a3 100644 |
| --- a/drivers/misc/habanalabs/goya/goya.c |
| +++ b/drivers/misc/habanalabs/goya/goya.c |
| @@ -4797,6 +4797,12 @@ void goya_handle_eqe(struct hl_device *hdev, struct hl_eq_entry *eq_entry) |
| >> EQ_CTL_EVENT_TYPE_SHIFT); |
| struct goya_device *goya = hdev->asic_specific; |
| |
| + if (event_type >= GOYA_ASYNC_EVENT_ID_SIZE) { |
| + dev_err(hdev->dev, "Event type %u exceeds maximum of %u", |
| + event_type, GOYA_ASYNC_EVENT_ID_SIZE - 1); |
| + return; |
| + } |
| + |
| goya->events_stat[event_type]++; |
| goya->events_stat_aggregate[event_type]++; |
| |
| -- |
| 2.33.0 |
| |