diff options
| author | Koby Elbaz <kelbaz@habana.ai> | 2022-12-23 16:02:05 +0300 |
|---|---|---|
| committer | Oded Gabbay <ogabbay@kernel.org> | 2023-01-26 12:52:11 +0300 |
| commit | 571d1a7222851ef5075f55702074ed7713dba304 (patch) | |
| tree | a5b1a03dcaff79fc82addf0d54ed579824862b65 /drivers/accel/habanalabs/common/device.c | |
| parent | c7d7b9aca2423d243748361cfb72e7fbdb8b37b9 (diff) | |
| download | linux-571d1a7222851ef5075f55702074ed7713dba304.tar.xz | |
habanalabs: protect access to dynamic mem 'user_mappings'
When HL_INFO_USER_MAPPINGS IOCTL is called, we copy_to_user from
a dynamically allocated memory - 'user_mappings'.
Since freeing/allocating it happens in runtime (upon a page fault),
it not unlikely to access it even before being initially allocated
(i.e., accessing a NULL pointer).
The solution is to simply mark the spot when the err info has been
collected, and that way to know whether err info (either page fault
or RAZWI) is available to be read.
Signed-off-by: Koby Elbaz <kelbaz@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Diffstat (limited to 'drivers/accel/habanalabs/common/device.c')
| -rw-r--r-- | drivers/accel/habanalabs/common/device.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/accel/habanalabs/common/device.c b/drivers/accel/habanalabs/common/device.c index e1b5a2c34986..6a05ab3fda23 100644 --- a/drivers/accel/habanalabs/common/device.c +++ b/drivers/accel/habanalabs/common/device.c @@ -2441,6 +2441,8 @@ void hl_capture_razwi(struct hl_device *hdev, u64 addr, u16 *engine_id, u16 num_ memcpy(&razwi_info->razwi.engine_id[0], &engine_id[0], num_of_engines * sizeof(u16)); razwi_info->razwi.flags = flags; + + razwi_info->razwi_info_available = true; } void hl_handle_razwi(struct hl_device *hdev, u64 addr, u16 *engine_id, u16 num_of_engines, @@ -2526,6 +2528,8 @@ void hl_capture_page_fault(struct hl_device *hdev, u64 addr, u16 eng_id, bool is pgf_info->page_fault.addr = addr; pgf_info->page_fault.engine_id = eng_id; hl_capture_user_mappings(hdev, is_pmmu); + + pgf_info->page_fault_info_available = true; } void hl_handle_page_fault(struct hl_device *hdev, u64 addr, u16 eng_id, bool is_pmmu, |