| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20221228160723.387-2-ogabbay@kernel.org>
Date: Wed, 28 Dec 2022 18:07:16 +0200
From: Oded Gabbay <ogabbay@...nel.org>
To: linux-kernel@...r.kernel.org
Cc: Tomer Tayar <ttayar@...ana.ai>
Subject: [PATCH 2/9] habanalabs: verify that kernel CB is destroyed only once
From: Tomer Tayar <ttayar@...ana.ai>
Remove the distinction between user CB and kernel CB, and verify for
both that they are not destroyed more than once.
As kernel CB might be taken from the pre-allocated CB pool, so we need
to clear the handle destroyed indication when returning a CB to the
pool.
Signed-off-by: Tomer Tayar <ttayar@...ana.ai>
Reviewed-by: Oded Gabbay <ogabbay@...nel.org>
Signed-off-by: Oded Gabbay <ogabbay@...nel.org>
---
.../accel/habanalabs/common/command_buffer.c | 32 ++++++++-----------
drivers/accel/habanalabs/common/device.c | 2 +-
drivers/accel/habanalabs/common/habanalabs.h | 4 +--
.../accel/habanalabs/common/habanalabs_drv.c | 2 +-
drivers/accel/habanalabs/common/memory_mgr.c | 4 +--
5 files changed, 18 insertions(+), 26 deletions(-)
diff --git a/drivers/accel/habanalabs/common/command_buffer.c b/drivers/accel/habanalabs/common/command_buffer.c
index 6263d01cb9c1..390011b02239 100644
--- a/drivers/accel/habanalabs/common/command_buffer.c
+++ b/drivers/accel/habanalabs/common/command_buffer.c
@@ -88,6 +88,7 @@ static void cb_fini(struct hl_device *hdev, struct hl_cb *cb)
static void cb_do_release(struct hl_device *hdev, struct hl_cb *cb)
{
if (cb->is_pool) {
+ atomic_set(&cb->is_handle_destroyed, 0);
spin_lock(&hdev->cb_pool_lock);
list_add(&cb->pool_list, &hdev->cb_pool);
spin_unlock(&hdev->cb_pool_lock);
@@ -301,28 +302,23 @@ int hl_cb_destroy(struct hl_mem_mgr *mmg, u64 cb_handle)
struct hl_cb *cb;
int rc;
- /* Make sure that a CB handle isn't destroyed by user more than once */
- if (!mmg->is_kernel_mem_mgr) {
- cb = hl_cb_get(mmg, cb_handle);
- if (!cb) {
- dev_dbg(mmg->dev, "CB destroy failed, no CB was found for handle %#llx\n",
- cb_handle);
- rc = -EINVAL;
- goto out;
- }
+ cb = hl_cb_get(mmg, cb_handle);
+ if (!cb) {
+ dev_dbg(mmg->dev, "CB destroy failed, no CB was found for handle %#llx\n",
+ cb_handle);
+ return -EINVAL;
+ }
- rc = atomic_cmpxchg(&cb->is_handle_destroyed, 0, 1);
- hl_cb_put(cb);
- if (rc) {
- dev_dbg(mmg->dev, "CB destroy failed, handle %#llx was already destroyed\n",
- cb_handle);
- rc = -EINVAL;
- goto out;
- }
+ /* Make sure that CB handle isn't destroyed more than once */
+ rc = atomic_cmpxchg(&cb->is_handle_destroyed, 0, 1);
+ hl_cb_put(cb);
+ if (rc) {
+ dev_dbg(mmg->dev, "CB destroy failed, handle %#llx was already destroyed\n",
+ cb_handle);
+ return -EINVAL;
}
rc = hl_mmap_mem_buf_put_handle(mmg, cb_handle);
-out:
if (rc < 0)
return rc; /* Invalid handle */
diff --git a/drivers/accel/habanalabs/common/device.c b/drivers/accel/habanalabs/common/device.c
index 6620580e9ba8..fe3540ed60d7 100644
--- a/drivers/accel/habanalabs/common/device.c
+++ b/drivers/accel/habanalabs/common/device.c
@@ -855,7 +855,7 @@ static int device_early_init(struct hl_device *hdev)
if (rc)
goto free_chip_info;
- hl_mem_mgr_init(hdev->dev, &hdev->kernel_mem_mgr, 1);
+ hl_mem_mgr_init(hdev->dev, &hdev->kernel_mem_mgr);
hdev->reset_wq = create_singlethread_workqueue("hl_device_reset");
if (!hdev->reset_wq) {
diff --git a/drivers/accel/habanalabs/common/habanalabs.h b/drivers/accel/habanalabs/common/habanalabs.h
index 95bbc00c6262..9bcefbef5ad7 100644
--- a/drivers/accel/habanalabs/common/habanalabs.h
+++ b/drivers/accel/habanalabs/common/habanalabs.h
@@ -876,13 +876,11 @@ struct hl_mmap_mem_buf;
* @dev: back pointer to the owning device
* @lock: protects handles
* @handles: an idr holding all active handles to the memory buffers in the system.
- * @is_kernel_mem_mgr: indicate whether the memory manager is the per-device kernel memory manager
*/
struct hl_mem_mgr {
struct device *dev;
spinlock_t lock;
struct idr handles;
- u8 is_kernel_mem_mgr;
};
/**
@@ -3824,7 +3822,7 @@ __printf(4, 5) int hl_snprintf_resize(char **buf, size_t *size, size_t *offset,
char *hl_format_as_binary(char *buf, size_t buf_len, u32 n);
const char *hl_sync_engine_to_string(enum hl_sync_engine_type engine_type);
-void hl_mem_mgr_init(struct device *dev, struct hl_mem_mgr *mmg, u8 is_kernel_mem_mgr);
+void hl_mem_mgr_init(struct device *dev, struct hl_mem_mgr *mmg);
void hl_mem_mgr_fini(struct hl_mem_mgr *mmg);
int hl_mem_mgr_mmap(struct hl_mem_mgr *mmg, struct vm_area_struct *vma,
void *args);
diff --git a/drivers/accel/habanalabs/common/habanalabs_drv.c b/drivers/accel/habanalabs/common/habanalabs_drv.c
index a2983913d7c0..7815c60df54e 100644
--- a/drivers/accel/habanalabs/common/habanalabs_drv.c
+++ b/drivers/accel/habanalabs/common/habanalabs_drv.c
@@ -164,7 +164,7 @@ int hl_device_open(struct inode *inode, struct file *filp)
nonseekable_open(inode, filp);
hl_ctx_mgr_init(&hpriv->ctx_mgr);
- hl_mem_mgr_init(hpriv->hdev->dev, &hpriv->mem_mgr, 0);
+ hl_mem_mgr_init(hpriv->hdev->dev, &hpriv->mem_mgr);
hpriv->taskpid = get_task_pid(current, PIDTYPE_PID);
diff --git a/drivers/accel/habanalabs/common/memory_mgr.c b/drivers/accel/habanalabs/common/memory_mgr.c
index 92d20ed465b4..0f2759e26547 100644
--- a/drivers/accel/habanalabs/common/memory_mgr.c
+++ b/drivers/accel/habanalabs/common/memory_mgr.c
@@ -308,16 +308,14 @@ int hl_mem_mgr_mmap(struct hl_mem_mgr *mmg, struct vm_area_struct *vma,
*
* @dev: owner device pointer
* @mmg: structure to initialize
- * @is_kernel_mem_mgr: indicate whether the memory manager is the per-device kernel memory manager
*
* Initialize an instance of unified memory manager
*/
-void hl_mem_mgr_init(struct device *dev, struct hl_mem_mgr *mmg, u8 is_kernel_mem_mgr)
+void hl_mem_mgr_init(struct device *dev, struct hl_mem_mgr *mmg)
{
mmg->dev = dev;
spin_lock_init(&mmg->lock);
idr_init(&mmg->handles);
- mmg->is_kernel_mem_mgr = is_kernel_mem_mgr;
}
/**
--
2.34.1
Powered by blists - more mailing lists