From: Oded Gabbay Date: Sun, 12 Jul 2020 20:34:57 +0000 (+0300) Subject: habanalabs: prevent possible out-of-bounds array access X-Git-Tag: v5.7.13~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f4ad9dbc0224db919f5387fa146e07f2006f50f2;p=thirdparty%2Fkernel%2Fstable.git habanalabs: prevent possible out-of-bounds array access [ Upstream commit cea7a0449ea3fa4883bf5dc8397f000d6b67d6cd ] Queue index is received from the user. Therefore, we must validate it before using it to access the queue props array. Signed-off-by: Oded Gabbay Reviewed-by: Tomer Tayar Signed-off-by: Sasha Levin --- diff --git a/drivers/misc/habanalabs/command_submission.c b/drivers/misc/habanalabs/command_submission.c index 409276b6374d7..e7c8e7473226f 100644 --- a/drivers/misc/habanalabs/command_submission.c +++ b/drivers/misc/habanalabs/command_submission.c @@ -425,11 +425,19 @@ static int validate_queue_index(struct hl_device *hdev, struct asic_fixed_properties *asic = &hdev->asic_prop; struct hw_queue_properties *hw_queue_prop; + /* This must be checked here to prevent out-of-bounds access to + * hw_queues_props array + */ + if (chunk->queue_index >= HL_MAX_QUEUES) { + dev_err(hdev->dev, "Queue index %d is invalid\n", + chunk->queue_index); + return -EINVAL; + } + hw_queue_prop = &asic->hw_queues_props[chunk->queue_index]; - if ((chunk->queue_index >= HL_MAX_QUEUES) || - (hw_queue_prop->type == QUEUE_TYPE_NA)) { - dev_err(hdev->dev, "Queue index %d is invalid\n", + if (hw_queue_prop->type == QUEUE_TYPE_NA) { + dev_err(hdev->dev, "Queue index %d is not applicable\n", chunk->queue_index); return -EINVAL; }