[PATCH] accel/habanalabs: Replace kmalloc_array + copy_from_user with memdup_array_user

Thorsten Blum
2025-09-08T20:36:31Z

Replace kmalloc_array() followed by copy_from_user() with
memdup_array_user() to improve and simplify cs_ioctl_engine_cores(),
cs_ioctl_engines(), and hl_multi_cs_wait_ioctl().

Remove the unused variable 'size_to_copy' from hl_multi_cs_wait_ioctl().

No functional changes intended.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
.../habanalabs/common/command_submission.c | 34 +++++--------------
1 file changed, 9 insertions(+), 25 deletions(-)

diff --git a/drivers/accel/habanalabs/common/command_submission.c b/drivers/accel/habanalabs/common/command_submission.c
index dee487724918..a5e339eb7a4f 100644
--- a/drivers/accel/habanalabs/common/command_submission.c
+++ b/drivers/accel/habanalabs/common/command_submission.c
@@ -2481,14 +2481,10 @@ static int cs_ioctl_engine_cores(struct hl_fpriv *hpriv, u64 engine_cores,
}

engine_cores_arr = (void __user *) (uintptr_t) engine_cores;
- cores = kmalloc_array(num_engine_cores, sizeof(u32), GFP_KERNEL);
- if (!cores)
- return -ENOMEM;
-
- if (copy_from_user(cores, engine_cores_arr, num_engine_cores * sizeof(u32))) {
+ cores = memdup_array_user(engine_cores_arr, num_engine_cores, sizeof(u32));
+ if (IS_ERR(cores)) {
dev_err(hdev->dev, "Failed to copy core-ids array from user\n");
- kfree(cores);
- return -EFAULT;
+ return PTR_ERR(cores);
}

rc = hdev->asic_funcs->set_engine_cores(hdev, cores, num_engine_cores, core_command);
@@ -2523,14 +2519,10 @@ static int cs_ioctl_engines(struct hl_fpriv *hpriv, u64 engines_arr_user_addr,
}

engines_arr = (void __user *) (uintptr_t) engines_arr_user_addr;
- engines = kmalloc_array(num_engines, sizeof(u32), GFP_KERNEL);
- if (!engines)
- return -ENOMEM;
-
- if (copy_from_user(engines, engines_arr, num_engines * sizeof(u32))) {
+ engines = memdup_array_user(engines_arr, num_engines, sizeof(u32));
+ if (IS_ERR(engines)) {
dev_err(hdev->dev, "Failed to copy engine-ids array from user\n");
- kfree(engines);
- return -EFAULT;
+ return PTR_ERR(engines);
}

rc = hdev->asic_funcs->set_engines(hdev, engines, num_engines, command);
@@ -3013,7 +3005,6 @@ static int hl_multi_cs_wait_ioctl(struct hl_fpriv *hpriv, void *data)
struct hl_ctx *ctx = hpriv->ctx;
struct hl_fence **fence_arr;
void __user *seq_arr;
- u32 size_to_copy;
u64 *cs_seq_arr;
u8 seq_arr_len;
int rc, i;
@@ -3037,19 +3028,12 @@ static int hl_multi_cs_wait_ioctl(struct hl_fpriv *hpriv, void *data)
return -EINVAL;
}

- /* allocate memory for sequence array */
- cs_seq_arr =
- kmalloc_array(seq_arr_len, sizeof(*cs_seq_arr), GFP_KERNEL);
- if (!cs_seq_arr)
- return -ENOMEM;
-
/* copy CS sequence array from user */
seq_arr = (void __user *) (uintptr_t) args->in.seq;
- size_to_copy = seq_arr_len * sizeof(*cs_seq_arr);
- if (copy_from_user(cs_seq_arr, seq_arr, size_to_copy)) {
+ cs_seq_arr = memdup_array_user(seq_arr, seq_arr_len, sizeof(*cs_seq_arr));
+ if (IS_ERR(cs_seq_arr)) {
dev_err(hdev->dev, "Failed to copy multi-cs sequence array from user\n");
- rc = -EFAULT;
- goto free_seq_arr;
+ return PTR_ERR(cs_seq_arr);
}

/* allocate array for the fences */
--
2.51.0