]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
habanalabs: fix debugfs code
authorJann Horn <jannh@google.com>
Sat, 4 May 2019 13:56:08 +0000 (15:56 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 11 Jun 2019 10:19:14 +0000 (12:19 +0200)
commitde3cfea50bafea1dfd9da6fb31198ab2ff2da424
treed91fda270ca166f6cbb75fff8912b5525b1823a9
parentf4277a2b8af588f734c938f21a047762de647587
habanalabs: fix debugfs code

commit 8438846cce61e284a22316c13aa4b63772963070 upstream.

This fixes multiple things in the habanalabs debugfs code, in particular:

 - mmu_write() was unnecessarily verbose, copying around between multiple
   buffers
 - mmu_write() could write a user-specified, unbounded amount of userspace
   memory into a kernel buffer (out-of-bounds write)
 - multiple debugfs read handlers ignored the user-supplied count,
   potentially corrupting out-of-bounds userspace data
 - hl_device_read() was unnecessarily verbose
 - hl_device_write() could read uninitialized stack memory
 - multiple debugfs read handlers copied terminating null characters to
   userspace

Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/habanalabs/debugfs.c