From nobody Tue Dec 16 13:21:42 2025 Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E30A1E487 for ; Mon, 3 Nov 2025 09:15:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762161359; cv=none; b=sg1XefxiXKOsGETqPAkJEVTOWrCymR+TDIwsy5IbrVGX13HRb9AVeVloFR6RjseMIMcijOucBmXY1P3dvpQsvXiC00RLJ7yVAfL0M4ih1GZj48HuBvDyW6feCbyTQNQBnNFQn08R1OVqVcqBMtjkRSS8xrRxCFrlih3FlOF2QG4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762161359; c=relaxed/simple; bh=SIqoX/jmCroub0PW6JtovdY8CGrSZR7NfSno/IIagqA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=m3bYT5+AndOBbcdsNOi/F885qLHUJA151yfvbm+uGWJ1ySERMNJHOVkRTqKDp9TaLFrlaI1FP98IZkZIgVTvnUOsT2FphpFHthEWHm2q6KOiGIht11EGFV+9fAd6tBbu8//c3eNVBMeySRqohY30j5b5feSONK63Rif4sHU5lvw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=m4c/EmKd; arc=none smtp.client-ip=91.218.175.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="m4c/EmKd" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1762161355; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=3KxtMFAfAVOECP/KQTtar5ebkakq1fKvsPkRn9H/Qm0=; b=m4c/EmKdimBsjdDekxoae/EcjziElpgw9F1ag5e/aUnTP1vwp18o3I4nua6szPxbCIShld QPQb0Nf4jp4qg1dZgKWf3wbegiWE3whrtbozzgZtURRrQ3jT7VcnigDiQhcz8jng3oRFQg tkaRzoW9CsbLIamliIo00ng8XgtDXbI= From: Thorsten Blum To: Koby Elbaz , Konstantin Sinyuk , Oded Gabbay , Andrew Morton , Easwar Hariharan Cc: Thorsten Blum , Karol Wachowski , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH RESEND] accel/habanalabs: Replace kmalloc_array + copy_from_user with memdup_array_user Date: Mon, 3 Nov 2025 10:15:24 +0100 Message-ID: <20251103091526.2393-2-thorsten.blum@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Replace kmalloc_array() followed by copy_from_user() with memdup_array_user() to improve and simplify cs_ioctl_engine_cores(), cs_ioctl_engines(), and hl_multi_cs_wait_ioctl(). Remove the unused variable 'size_to_copy' from hl_multi_cs_wait_ioctl(). No functional changes intended. Reviewed-by: Karol Wachowski Reviewed-by: Konstantin Sinyuk Signed-off-by: Thorsten Blum --- .../habanalabs/common/command_submission.c | 34 +++++-------------- 1 file changed, 9 insertions(+), 25 deletions(-) diff --git a/drivers/accel/habanalabs/common/command_submission.c b/drivers= /accel/habanalabs/common/command_submission.c index dee487724918..a5e339eb7a4f 100644 --- a/drivers/accel/habanalabs/common/command_submission.c +++ b/drivers/accel/habanalabs/common/command_submission.c @@ -2481,14 +2481,10 @@ static int cs_ioctl_engine_cores(struct hl_fpriv *h= priv, u64 engine_cores, } =20 engine_cores_arr =3D (void __user *) (uintptr_t) engine_cores; - cores =3D kmalloc_array(num_engine_cores, sizeof(u32), GFP_KERNEL); - if (!cores) - return -ENOMEM; - - if (copy_from_user(cores, engine_cores_arr, num_engine_cores * sizeof(u32= ))) { + cores =3D memdup_array_user(engine_cores_arr, num_engine_cores, sizeof(u3= 2)); + if (IS_ERR(cores)) { dev_err(hdev->dev, "Failed to copy core-ids array from user\n"); - kfree(cores); - return -EFAULT; + return PTR_ERR(cores); } =20 rc =3D hdev->asic_funcs->set_engine_cores(hdev, cores, num_engine_cores, = core_command); @@ -2523,14 +2519,10 @@ static int cs_ioctl_engines(struct hl_fpriv *hpriv,= u64 engines_arr_user_addr, } =20 engines_arr =3D (void __user *) (uintptr_t) engines_arr_user_addr; - engines =3D kmalloc_array(num_engines, sizeof(u32), GFP_KERNEL); - if (!engines) - return -ENOMEM; - - if (copy_from_user(engines, engines_arr, num_engines * sizeof(u32))) { + engines =3D memdup_array_user(engines_arr, num_engines, sizeof(u32)); + if (IS_ERR(engines)) { dev_err(hdev->dev, "Failed to copy engine-ids array from user\n"); - kfree(engines); - return -EFAULT; + return PTR_ERR(engines); } =20 rc =3D hdev->asic_funcs->set_engines(hdev, engines, num_engines, command); @@ -3013,7 +3005,6 @@ static int hl_multi_cs_wait_ioctl(struct hl_fpriv *hp= riv, void *data) struct hl_ctx *ctx =3D hpriv->ctx; struct hl_fence **fence_arr; void __user *seq_arr; - u32 size_to_copy; u64 *cs_seq_arr; u8 seq_arr_len; int rc, i; @@ -3037,19 +3028,12 @@ static int hl_multi_cs_wait_ioctl(struct hl_fpriv *= hpriv, void *data) return -EINVAL; } =20 - /* allocate memory for sequence array */ - cs_seq_arr =3D - kmalloc_array(seq_arr_len, sizeof(*cs_seq_arr), GFP_KERNEL); - if (!cs_seq_arr) - return -ENOMEM; - /* copy CS sequence array from user */ seq_arr =3D (void __user *) (uintptr_t) args->in.seq; - size_to_copy =3D seq_arr_len * sizeof(*cs_seq_arr); - if (copy_from_user(cs_seq_arr, seq_arr, size_to_copy)) { + cs_seq_arr =3D memdup_array_user(seq_arr, seq_arr_len, sizeof(*cs_seq_arr= )); + if (IS_ERR(cs_seq_arr)) { dev_err(hdev->dev, "Failed to copy multi-cs sequence array from user\n"); - rc =3D -EFAULT; - goto free_seq_arr; + return PTR_ERR(cs_seq_arr); } =20 /* allocate array for the fences */ --=20 2.51.1