Commit 991cf553 authored by Ofir Bitton's avatar Ofir Bitton Committed by Zheng Zengkai
Browse files

habanalabs: add validity check for event ID received from F/W 

stable inclusion
from stable-5.10.69
commit db8838e48a0a7f30bc6d4d6f0f9cd4e2f06c289f
bugzilla: 182675 https://gitee.com/openeuler/kernel/issues/I4I3ED

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=db8838e48a0a7f30bc6d4d6f0f9cd4e2f06c289f



--------------------------------

[ Upstream commit a6c84901 ]

Currently there is no validity check for event ID received from F/W,
Thus exposing driver to memory overrun.

Signed-off-by: default avatarOfir Bitton <obitton@habana.ai>
Reviewed-by: default avatarOded Gabbay <ogabbay@kernel.org>
Signed-off-by: default avatarOded Gabbay <ogabbay@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Acked-by: default avatarWeilong Chen <chenweilong@huawei.com>

Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent aa06bae4

drivers/misc/habanalabs/gaudi/gaudi.c

+6 −0
Original line number Diff line number Diff line
@@ -5723,6 +5723,12 @@ static void gaudi_handle_eqe(struct hl_device *hdev, 
	u8 cause;

	bool reset_required;



	if (event_type >= GAUDI_EVENT_SIZE) {

		dev_err(hdev->dev, "Event type %u exceeds maximum of %u",

				event_type, GAUDI_EVENT_SIZE - 1);

		return;

	}



	gaudi->events_stat[event_type]++;

	gaudi->events_stat_aggregate[event_type]++;

drivers/misc/habanalabs/goya/goya.c

+6 −0
Original line number Diff line number Diff line
@@ -4623,6 +4623,12 @@ void goya_handle_eqe(struct hl_device *hdev, struct hl_eq_entry *eq_entry) 
				>> EQ_CTL_EVENT_TYPE_SHIFT);

	struct goya_device *goya = hdev->asic_specific;



	if (event_type >= GOYA_ASYNC_EVENT_ID_SIZE) {

		dev_err(hdev->dev, "Event type %u exceeds maximum of %u",

				event_type, GOYA_ASYNC_EVENT_ID_SIZE - 1);

		return;

	}



	goya->events_stat[event_type]++;

	goya->events_stat_aggregate[event_type]++;