Skip to content

Commit

Permalink
habanalabs: proper handling of alloc size in coresight
Browse files Browse the repository at this point in the history
Allocation size can go up to 64bit but truncated to 32bit,
we should make sure it is not truncated and validate no address
overflow.

Signed-off-by: Ofir Bitton <obitton@habana.ai>
Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
  • Loading branch information
Ofir Bitton authored and Oded Gabbay committed Aug 22, 2020
1 parent f44d23b commit 3654527
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 3 deletions.
2 changes: 1 addition & 1 deletion drivers/misc/habanalabs/common/habanalabs.h
Original file line number Diff line number Diff line change
Expand Up @@ -1651,7 +1651,7 @@ struct hl_ioctl_desc {
*
* Return: true if the area is inside the valid range, false otherwise.
*/
static inline bool hl_mem_area_inside_range(u64 address, u32 size,
static inline bool hl_mem_area_inside_range(u64 address, u64 size,
u64 range_start_address, u64 range_end_address)
{
u64 end_address = address + size;
Expand Down
8 changes: 7 additions & 1 deletion drivers/misc/habanalabs/gaudi/gaudi_coresight.c
Original file line number Diff line number Diff line change
Expand Up @@ -527,7 +527,7 @@ static int gaudi_config_etf(struct hl_device *hdev,
}

static bool gaudi_etr_validate_address(struct hl_device *hdev, u64 addr,
u32 size, bool *is_host)
u64 size, bool *is_host)
{
struct asic_fixed_properties *prop = &hdev->asic_prop;
struct gaudi_device *gaudi = hdev->asic_specific;
Expand All @@ -539,6 +539,12 @@ static bool gaudi_etr_validate_address(struct hl_device *hdev, u64 addr,
return false;
}

if (addr > (addr + size)) {
dev_err(hdev->dev,
"ETR buffer size %llu overflow\n", size);
return false;
}

/* PMMU and HPMMU addresses are equal, check only one of them */
if ((gaudi->hw_cap_initialized & HW_CAP_MMU) &&
hl_mem_area_inside_range(addr, size,
Expand Down
8 changes: 7 additions & 1 deletion drivers/misc/habanalabs/goya/goya_coresight.c
Original file line number Diff line number Diff line change
Expand Up @@ -362,11 +362,17 @@ static int goya_config_etf(struct hl_device *hdev,
}

static int goya_etr_validate_address(struct hl_device *hdev, u64 addr,
u32 size)
u64 size)
{
struct asic_fixed_properties *prop = &hdev->asic_prop;
u64 range_start, range_end;

if (addr > (addr + size)) {
dev_err(hdev->dev,
"ETR buffer size %llu overflow\n", size);
return false;
}

if (hdev->mmu_enable) {
range_start = prop->dmmu.start_addr;
range_end = prop->dmmu.end_addr;
Expand Down

0 comments on commit 3654527

Please sign in to comment.