habanalabs: add validity check for event ID received from F/W

[ Upstream commit a6c849012b0f51c674f52384bd9a4f3dc0a33c31 ]

Currently there is no validity check for event ID received from F/W,
Thus exposing driver to memory overrun.

Signed-off-by: Ofir Bitton <obitton@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
index 37edd663603f69d086aeea4a2e1f4aca9eeaa1bb..ebac53a73bd10736202f0fc57149bc34540c36d0 100644 (file)
--- a/drivers/misc/habanalabs/gaudi/gaudi.c
+++ b/drivers/misc/habanalabs/gaudi/gaudi.c
@@ -5723,6 +5723,12 @@ static void gaudi_handle_eqe(struct hl_device *hdev,
        u8 cause;
        bool reset_required;
 
+       if (event_type >= GAUDI_EVENT_SIZE) {
+               dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
+                               event_type, GAUDI_EVENT_SIZE - 1);
+               return;
+       }
+
        gaudi->events_stat[event_type]++;
        gaudi->events_stat_aggregate[event_type]++;
 

diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
index 5b5d6275c2495b8b8d2698ad9e6c64438e4d2278..c8023b4428c5cadc5c47fb344bcb46f803311ef1 100644 (file)
--- a/drivers/misc/habanalabs/goya/goya.c
+++ b/drivers/misc/habanalabs/goya/goya.c
@@ -4623,6 +4623,12 @@ void goya_handle_eqe(struct hl_device *hdev, struct hl_eq_entry *eq_entry)
                                >> EQ_CTL_EVENT_TYPE_SHIFT);
        struct goya_device *goya = hdev->asic_specific;
 
+       if (event_type >= GOYA_ASYNC_EVENT_ID_SIZE) {
+               dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
+                               event_type, GOYA_ASYNC_EVENT_ID_SIZE - 1);
+               return;
+       }
+
        goya->events_stat[event_type]++;
        goya->events_stat_aggregate[event_type]++;