From: Oded Gabbay oded.gabbay@gmail.com
[ Upstream commit cea7a0449ea3fa4883bf5dc8397f000d6b67d6cd ]
Queue index is received from the user. Therefore, we must validate it before using it to access the queue props array.
Signed-off-by: Oded Gabbay oded.gabbay@gmail.com Reviewed-by: Tomer Tayar ttayar@habana.ai Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/misc/habanalabs/command_submission.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/misc/habanalabs/command_submission.c b/drivers/misc/habanalabs/command_submission.c index 447f307ef4d6f..ef95ee33cea40 100644 --- a/drivers/misc/habanalabs/command_submission.c +++ b/drivers/misc/habanalabs/command_submission.c @@ -400,15 +400,23 @@ static struct hl_cb *validate_queue_index(struct hl_device *hdev, /* Assume external queue */ *ext_queue = true;
- hw_queue_prop = &asic->hw_queues_props[chunk->queue_index]; - - if ((chunk->queue_index >= HL_MAX_QUEUES) || - (hw_queue_prop->type == QUEUE_TYPE_NA)) { + /* This must be checked here to prevent out-of-bounds access to + * hw_queues_props array + */ + if (chunk->queue_index >= HL_MAX_QUEUES) { dev_err(hdev->dev, "Queue index %d is invalid\n", chunk->queue_index); return NULL; }
+ hw_queue_prop = &asic->hw_queues_props[chunk->queue_index]; + + if (hw_queue_prop->type == QUEUE_TYPE_NA) { + dev_err(hdev->dev, "Queue index %d is not applicable\n", + chunk->queue_index); + return -EINVAL; + } + if (hw_queue_prop->driver_only) { dev_err(hdev->dev, "Queue index %d is restricted for the kernel driver\n",