diff options
| author | farah kassabri <fkassabri@habana.ai> | 2022-06-13 16:22:20 +0300 |
|---|---|---|
| committer | Oded Gabbay <ogabbay@kernel.org> | 2022-07-12 09:09:23 +0300 |
| commit | d64a29af120ece3a81cd46a8880fbe4111f9be27 (patch) | |
| tree | 255000b40aeba5296db339f35ba90617d977b4b9 | |
| parent | 70d25e96b69eca96ded689dff8ea3e0decdf9cf7 (diff) | |
| download | linux-stable-d64a29af120ece3a81cd46a8880fbe4111f9be27.tar.gz linux-stable-d64a29af120ece3a81cd46a8880fbe4111f9be27.tar.bz2 linux-stable-d64a29af120ece3a81cd46a8880fbe4111f9be27.zip | |
habanalabs: add validity check for cq counter offset
Driver performs no validity check for the user cq counter offset
used in both wait_for_interrupt and register_for_timestamp APIs.
Signed-off-by: farah kassabri <fkassabri@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
| -rw-r--r-- | drivers/misc/habanalabs/common/command_submission.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/misc/habanalabs/common/command_submission.c b/drivers/misc/habanalabs/common/command_submission.c index cbb7c29966ff..72a557b83a7d 100644 --- a/drivers/misc/habanalabs/common/command_submission.c +++ b/drivers/misc/habanalabs/common/command_submission.c @@ -2979,7 +2979,7 @@ static int ts_buff_get_kernel_ts_record(struct hl_mmap_mem_buf *buf, u64 current_cq_counter; /* Validate ts_offset not exceeding last max */ - if (requested_offset_record > cb_last) { + if (requested_offset_record >= cb_last) { dev_err(buf->mmg->dev, "Ts offset exceeds max CB offset(0x%llx)\n", (u64)(uintptr_t)cb_last); return -EINVAL; @@ -3064,6 +3064,13 @@ static int _hl_interrupt_wait_ioctl(struct hl_device *hdev, struct hl_ctx *ctx, goto put_ctx; } + /* Validate the cq offset */ + if (((u64 *) cq_cb->kernel_address + cq_counters_offset) >= + ((u64 *) cq_cb->kernel_address + (cq_cb->size / sizeof(u64)))) { + rc = -EINVAL; + goto put_cq_cb; + } + if (register_ts_record) { dev_dbg(hdev->dev, "Timestamp registration: interrupt id: %u, ts offset: %llu, cq_offset: %llu\n", interrupt->interrupt_id, ts_offset, cq_counters_offset); |