habanalabs: fix debugfs code
authorJann Horn <jannh@google.com>
Sat, 4 May 2019 13:56:08 +0000 (15:56 +0200)
committerOded Gabbay <oded.gabbay@gmail.com>
Fri, 24 May 2019 19:46:15 +0000 (22:46 +0300)
commit8438846cce61e284a22316c13aa4b63772963070
tree48086674deda57429a2e19443a6964463f2f3db2
parent2add64ebaea25dfada27b3332b1c982f9fc5ae64
habanalabs: fix debugfs code

This fixes multiple things in the habanalabs debugfs code, in particular:

 - mmu_write() was unnecessarily verbose, copying around between multiple
   buffers
 - mmu_write() could write a user-specified, unbounded amount of userspace
   memory into a kernel buffer (out-of-bounds write)
 - multiple debugfs read handlers ignored the user-supplied count,
   potentially corrupting out-of-bounds userspace data
 - hl_device_read() was unnecessarily verbose
 - hl_device_write() could read uninitialized stack memory
 - multiple debugfs read handlers copied terminating null characters to
   userspace

Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Cc: stable@vger.kernel.org
drivers/misc/habanalabs/debugfs.c