Merge tag 'samsung-soc-5.10' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk...

[linux-2.6-microblaze.git] / drivers / misc / habanalabs / goya / goya.c

diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
index 8503075..33cd2ae 100644 (file)
--- a/drivers/misc/habanalabs/goya/goya.c
+++ b/drivers/misc/habanalabs/goya/goya.c
@@ -139,6 +139,25 @@ static u16 goya_packet_sizes[MAX_PACKET_ID] = {
        [PACKET_STOP]           = sizeof(struct packet_stop)
 };
 
+static inline bool validate_packet_id(enum packet_id id)
+{
+       switch (id) {
+       case PACKET_WREG_32:
+       case PACKET_WREG_BULK:
+       case PACKET_MSG_LONG:
+       case PACKET_MSG_SHORT:
+       case PACKET_CP_DMA:
+       case PACKET_MSG_PROT:
+       case PACKET_FENCE:
+       case PACKET_LIN_DMA:
+       case PACKET_NOP:
+       case PACKET_STOP:
+               return true;
+       default:
+               return false;
+       }
+}
+
 static u64 goya_mmu_regs[GOYA_MMU_REGS_NUM] = {
        mmDMA_QM_0_GLBL_NON_SECURE_PROPS,
        mmDMA_QM_1_GLBL_NON_SECURE_PROPS,
@@ -3455,6 +3474,12 @@ static int goya_validate_cb(struct hl_device *hdev,
                                PACKET_HEADER_PACKET_ID_MASK) >>
                                        PACKET_HEADER_PACKET_ID_SHIFT);
 
+               if (!validate_packet_id(pkt_id)) {
+                       dev_err(hdev->dev, "Invalid packet id %u\n", pkt_id);
+                       rc = -EINVAL;
+                       break;
+               }
+
                pkt_size = goya_packet_sizes[pkt_id];
                cb_parsed_length += pkt_size;
                if (cb_parsed_length > parser->user_cb_size) {
@@ -3690,6 +3715,12 @@ static int goya_patch_cb(struct hl_device *hdev,
                                PACKET_HEADER_PACKET_ID_MASK) >>
                                        PACKET_HEADER_PACKET_ID_SHIFT);
 
+               if (!validate_packet_id(pkt_id)) {
+                       dev_err(hdev->dev, "Invalid packet id %u\n", pkt_id);
+                       rc = -EINVAL;
+                       break;
+               }
+
                pkt_size = goya_packet_sizes[pkt_id];
                cb_parsed_length += pkt_size;
                if (cb_parsed_length > parser->user_cb_size) {