diff options
| author | Ofir Bitton <obitton@habana.ai> | 2021-07-20 09:16:05 +0300 |
|---|---|---|
| committer | Oded Gabbay <ogabbay@kernel.org> | 2021-09-01 18:38:24 +0300 |
| commit | a6c849012b0f51c674f52384bd9a4f3dc0a33c31 (patch) | |
| tree | 5eec2c3e7b4f8f66d29344f528bea23ad78b44f3 /drivers/misc | |
| parent | cc5b4c4c75c43184c1d8684299efef2a68b87720 (diff) | |
habanalabs: add validity check for event ID received from F/W
Currently there is no validity check for event ID received from F/W,
Thus exposing driver to memory overrun.
Signed-off-by: Ofir Bitton <obitton@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Diffstat (limited to 'drivers/misc')
| -rw-r--r-- | drivers/misc/habanalabs/gaudi/gaudi.c | 6 | ||||
| -rw-r--r-- | drivers/misc/habanalabs/goya/goya.c | 6 |
2 files changed, 12 insertions, 0 deletions
diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c index 18fec7decb99..88e181521d90 100644 --- a/drivers/misc/habanalabs/gaudi/gaudi.c +++ b/drivers/misc/habanalabs/gaudi/gaudi.c @@ -7880,6 +7880,12 @@ static void gaudi_handle_eqe(struct hl_device *hdev, u8 cause; int rc; + if (event_type >= GAUDI_EVENT_SIZE) { + dev_err(hdev->dev, "Event type %u exceeds maximum of %u", + event_type, GAUDI_EVENT_SIZE - 1); + return; + } + gaudi->events_stat[event_type]++; gaudi->events_stat_aggregate[event_type]++; diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c index e690161a07d2..d956088abbd1 100644 --- a/drivers/misc/habanalabs/goya/goya.c +++ b/drivers/misc/habanalabs/goya/goya.c @@ -4804,6 +4804,12 @@ void goya_handle_eqe(struct hl_device *hdev, struct hl_eq_entry *eq_entry) >> EQ_CTL_EVENT_TYPE_SHIFT); struct goya_device *goya = hdev->asic_specific; + if (event_type >= GOYA_ASYNC_EVENT_ID_SIZE) { + dev_err(hdev->dev, "Event type %u exceeds maximum of %u", + event_type, GOYA_ASYNC_EVENT_ID_SIZE - 1); + return; + } + goya->events_stat[event_type]++; goya->events_stat_aggregate[event_type]++; |