Commit a6c84901 authored Jul 20, 2021 by Ofir Bitton Committed by Oded Gabbay Sep 01, 2021

habanalabs: add validity check for event ID received from F/W



Currently there is no validity check for event ID received from F/W,
Thus exposing driver to memory overrun.

Signed-off-by: Ofir Bitton <obitton@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>

parent cc5b4c4c

drivers/misc/habanalabs/gaudi/gaudi.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -7880,6 +7880,12 @@ static void gaudi_handle_eqe(struct hl_device *hdev,
		u8 cause;
		int rc;

		if (event_type >= GAUDI_EVENT_SIZE) {
		dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
		event_type, GAUDI_EVENT_SIZE - 1);
		return;
		}

		gaudi->events_stat[event_type]++;
		gaudi->events_stat_aggregate[event_type]++;

drivers/misc/habanalabs/goya/goya.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -4804,6 +4804,12 @@ void goya_handle_eqe(struct hl_device hdev, struct hl_eq_entry eq_entry)
		>> EQ_CTL_EVENT_TYPE_SHIFT);
		struct goya_device *goya = hdev->asic_specific;

		if (event_type >= GOYA_ASYNC_EVENT_ID_SIZE) {
		dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
		event_type, GOYA_ASYNC_EVENT_ID_SIZE - 1);
		return;
		}

		goya->events_stat[event_type]++;
		goya->events_stat_aggregate[event_type]++;