habanalabs: don't allow user to destroy CB handle more than once
authorTomer Tayar <ttayar@habana.ai>
Wed, 23 Nov 2022 13:09:43 +0000 (15:09 +0200)
committerOded Gabbay <ogabbay@kernel.org>
Thu, 26 Jan 2023 08:56:20 +0000 (10:56 +0200)
commit6003cb46e661e134e9e1f1449a6ea77d1e4ba6a9
tree08f0d797060686dd52392527edf57f2462da4774
parent6710444cfeb533f8c7817c7ec1adfb52206a6d00
habanalabs: don't allow user to destroy CB handle more than once

The refcount of a CB buffer is initialized when user allocates a CB,
and is decreased when he destroys the CB handle.

If this refcount is increased also from kernel and user sends more than
one destroy requests for the handle, the buffer will be released/freed
and later be accessed when the refcount is put from kernel side.

To avoid it, prevent user from destroying the handle more than once.

Signed-off-by: Tomer Tayar <ttayar@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
drivers/misc/habanalabs/common/command_buffer.c
drivers/misc/habanalabs/common/device.c
drivers/misc/habanalabs/common/habanalabs.h
drivers/misc/habanalabs/common/habanalabs_drv.c
drivers/misc/habanalabs/common/memory_mgr.c