• Jann Horn's avatar
    habanalabs: fix debugfs code · 8438846c
    Jann Horn authored
    This fixes multiple things in the habanalabs debugfs code, in particular:
    
     - mmu_write() was unnecessarily verbose, copying around between multiple
       buffers
     - mmu_write() could write a user-specified, unbounded amount of userspace
       memory into a kernel buffer (out-of-bounds write)
     - multiple debugfs read handlers ignored the user-supplied count,
       potentially corrupting out-of-bounds userspace data
     - hl_device_read() was unnecessarily verbose
     - hl_device_write() could read uninitialized stack memory
     - multiple debugfs read handlers copied terminating null characters to
       userspace
    Signed-off-by: default avatarJann Horn <jannh@google.com>
    Reviewed-by: default avatarOded Gabbay <oded.gabbay@gmail.com>
    Signed-off-by: default avatarOded Gabbay <oded.gabbay@gmail.com>
    Cc: stable@vger.kernel.org
    8438846c
debugfs.c 28 KB