linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 5.10 1/8] habanalabs: add validity check for event ID received from F/W
@ 2021-09-17  2:34 Sasha Levin
  2021-09-17  2:34 ` [PATCH AUTOSEL 5.10 2/8] pwm: img: Don't modify HW state in .remove() callback Sasha Levin
                   ` (6 more replies)
  0 siblings, 7 replies; 8+ messages in thread
From: Sasha Levin @ 2021-09-17  2:34 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Ofir Bitton, Oded Gabbay, Sasha Levin, Arnd, gregkh, osharabi,
	kelbaz, ttayar, ynudelman, fkassabri, amizrahi, bjauhari

From: Ofir Bitton <obitton@habana.ai>

[ Upstream commit a6c849012b0f51c674f52384bd9a4f3dc0a33c31 ]

Currently there is no validity check for event ID received from F/W,
Thus exposing driver to memory overrun.

Signed-off-by: Ofir Bitton <obitton@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/habanalabs/gaudi/gaudi.c | 6 ++++++
 drivers/misc/habanalabs/goya/goya.c   | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
index 37edd663603f..ebac53a73bd1 100644
--- a/drivers/misc/habanalabs/gaudi/gaudi.c
+++ b/drivers/misc/habanalabs/gaudi/gaudi.c
@@ -5723,6 +5723,12 @@ static void gaudi_handle_eqe(struct hl_device *hdev,
 	u8 cause;
 	bool reset_required;
 
+	if (event_type >= GAUDI_EVENT_SIZE) {
+		dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
+				event_type, GAUDI_EVENT_SIZE - 1);
+		return;
+	}
+
 	gaudi->events_stat[event_type]++;
 	gaudi->events_stat_aggregate[event_type]++;
 
diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
index 5b5d6275c249..c8023b4428c5 100644
--- a/drivers/misc/habanalabs/goya/goya.c
+++ b/drivers/misc/habanalabs/goya/goya.c
@@ -4623,6 +4623,12 @@ void goya_handle_eqe(struct hl_device *hdev, struct hl_eq_entry *eq_entry)
 				>> EQ_CTL_EVENT_TYPE_SHIFT);
 	struct goya_device *goya = hdev->asic_specific;
 
+	if (event_type >= GOYA_ASYNC_EVENT_ID_SIZE) {
+		dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
+				event_type, GOYA_ASYNC_EVENT_ID_SIZE - 1);
+		return;
+	}
+
 	goya->events_stat[event_type]++;
 	goya->events_stat_aggregate[event_type]++;
 
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2021-09-17  2:35 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-17  2:34 [PATCH AUTOSEL 5.10 1/8] habanalabs: add validity check for event ID received from F/W Sasha Levin
2021-09-17  2:34 ` [PATCH AUTOSEL 5.10 2/8] pwm: img: Don't modify HW state in .remove() callback Sasha Levin
2021-09-17  2:34 ` [PATCH AUTOSEL 5.10 3/8] pwm: rockchip: " Sasha Levin
2021-09-17  2:34 ` [PATCH AUTOSEL 5.10 4/8] pwm: stm32-lp: " Sasha Levin
2021-09-17  2:34 ` [PATCH AUTOSEL 5.10 5/8] blk-throttle: fix UAF by deleteing timer in blk_throtl_exit() Sasha Levin
2021-09-17  2:34 ` [PATCH AUTOSEL 5.10 6/8] blk-mq: allow 4x BLK_MAX_REQUEST_COUNT at blk_plug for multiple_queues Sasha Levin
2021-09-17  2:34 ` [PATCH AUTOSEL 5.10 7/8] rtc: rx8010: select REGMAP_I2C Sasha Levin
2021-09-17  2:34 ` [PATCH AUTOSEL 5.10 8/8] sched/idle: Make the idle timer expire in hard interrupt context Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).