android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

habanalabs: add validity check for event ID received from F/W

Browse Source 
[ Upstream commit a6c849012b0f51c674f52384bd9a4f3dc0a33c31 ]

Currently there is no validity check for event ID received from F/W,
Thus exposing driver to memory overrun.

Signed-off-by: Ofir Bitton <obitton@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Ofir Bitton 2021-07-20 09:16:05 +03:00 committed by Greg Kroah-Hartman
parent d7736e2faa
commit db8838e48a
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/misc/habanalabs/gaudi/gaudi.c
View File

@ -5723,6 +5723,12 @@ static void gaudi_handle_eqe(struct hl_device *hdev,
u8 cause;
bool reset_required;
if (event_type >= GAUDI_EVENT_SIZE) {
dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
event_type, GAUDI_EVENT_SIZE - 1);
return;
}
gaudi->events_stat[event_type]++;
gaudi->events_stat_aggregate[event_type]++;

6
drivers/misc/habanalabs/goya/goya.c
View File

@ -4623,6 +4623,12 @@ void goya_handle_eqe(struct hl_device *hdev, struct hl_eq_entry *eq_entry)
>> EQ_CTL_EVENT_TYPE_SHIFT);
struct goya_device *goya = hdev->asic_specific;
if (event_type >= GOYA_ASYNC_EVENT_ID_SIZE) {
dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
event_type, GOYA_ASYNC_EVENT_ID_SIZE - 1);
return;
}
goya->events_stat[event_type]++;
goya->events_stat_aggregate[event_type]++;