summaryrefslogtreecommitdiff
path: root/drivers/misc
diff options
context:
space:
mode:
authorOmer Shpigelman <oshpigelman@habana.ai>2019-08-06 10:37:59 +0300
committerOded Gabbay <oded.gabbay@gmail.com>2019-09-05 14:55:27 +0300
commit8d1759329d042ecad31754c5f37b3ca5cbf106f5 (patch)
treed252a90891deafebac6f9f9f14bfa33d0d39b890 /drivers/misc
parent10d7de2cdb873096a823bc56eb8321f9ad7f7c3a (diff)
downloadlinux-8d1759329d042ecad31754c5f37b3ca5cbf106f5.tar.xz
habanalabs: use default structure for user input in Debug IOCTL
This patch fixes a possible kernel crash when a user provides a too small input structure to the Debug IOCTL. The fix sets a default input structure and copies to it the user data. In case the user provided as input a too small structure, the code will use the default values taken from the default structure. Note that in contrary to the input structure, the user can provide an output structure with changing size or no size at all. Therefore the user output structure validation is already done in the Debug logic later on. Signed-off-by: Omer Shpigelman <oshpigelman@habana.ai> Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com> Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Diffstat (limited to 'drivers/misc')
-rw-r--r--drivers/misc/habanalabs/habanalabs_ioctl.c17
1 files changed, 10 insertions, 7 deletions
diff --git a/drivers/misc/habanalabs/habanalabs_ioctl.c b/drivers/misc/habanalabs/habanalabs_ioctl.c
index 9deb02b18eb2..6351fbf10ddc 100644
--- a/drivers/misc/habanalabs/habanalabs_ioctl.c
+++ b/drivers/misc/habanalabs/habanalabs_ioctl.c
@@ -144,13 +144,16 @@ static int debug_coresight(struct hl_device *hdev, struct hl_debug_args *args)
params->op = args->op;
if (args->input_ptr && args->input_size) {
- input = memdup_user(u64_to_user_ptr(args->input_ptr),
- args->input_size);
- if (IS_ERR(input)) {
- rc = PTR_ERR(input);
- input = NULL;
- dev_err(hdev->dev,
- "error %d when copying input debug data\n", rc);
+ input = kzalloc(hl_debug_struct_size[args->op], GFP_KERNEL);
+ if (!input) {
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ if (copy_from_user(input, u64_to_user_ptr(args->input_ptr),
+ args->input_size)) {
+ rc = -EFAULT;
+ dev_err(hdev->dev, "failed to copy input debug data\n");
goto out;
}