Re: [PATCH] accel/habanalabs: Replace kmalloc_array + copy_from_user with memdup_array_user

Karol Wachowski
2025-09-09T08:32:38Z

|Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>|

W dniu 08.09.2025 o 22:35, Thorsten Blum pisze:

> Replace kmalloc_array() followed by copy_from_user() with
> memdup_array_user() to improve and simplify cs_ioctl_engine_cores(),
> cs_ioctl_engines(), and hl_multi_cs_wait_ioctl().
>
> Remove the unused variable 'size_to_copy' from hl_multi_cs_wait_ioctl().
>
> No functional changes intended.
>
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> ---
> .../habanalabs/common/command_submission.c | 34 +++++--------------
> 1 file changed, 9 insertions(+), 25 deletions(-)
>
> diff --git a/drivers/accel/habanalabs/common/command_submission.c b/drivers/accel/habanalabs/common/command_submission.c
> index dee487724918..a5e339eb7a4f 100644
> --- a/drivers/accel/habanalabs/common/command_submission.c
> +++ b/drivers/accel/habanalabs/common/command_submission.c
> @@ -2481,14 +2481,10 @@ static int cs_ioctl_engine_cores(struct hl_fpriv *hpriv, u64 engine_cores,
> }
>
> engine_cores_arr = (void __user *) (uintptr_t) engine_cores;
> - cores = kmalloc_array(num_engine_cores, sizeof(u32), GFP_KERNEL);
> - if (!cores)
> - return -ENOMEM;
> -
> - if (copy_from_user(cores, engine_cores_arr, num_engine_cores * sizeof(u32))) {
> + cores = memdup_array_user(engine_cores_arr, num_engine_cores, sizeof(u32));
> + if (IS_ERR(cores)) {
> dev_err(hdev->dev, "Failed to copy core-ids array from user\n");
> - kfree(cores);
> - return -EFAULT;
> + return PTR_ERR(cores);
> }
>
> rc = hdev->asic_funcs->set_engine_cores(hdev, cores, num_engine_cores, core_command);
> @@ -2523,14 +2519,10 @@ static int cs_ioctl_engines(struct hl_fpriv *hpriv, u64 engines_arr_user_addr,
> }
>
> engines_arr = (void __user *) (uintptr_t) engines_arr_user_addr;
> - engines = kmalloc_array(num_engines, sizeof(u32), GFP_KERNEL);
> - if (!engines)
> - return -ENOMEM;
> -
> - if (copy_from_user(engines, engines_arr, num_engines * sizeof(u32))) {
> + engines = memdup_array_user(engines_arr, num_engines, sizeof(u32));
> + if (IS_ERR(engines)) {
> dev_err(hdev->dev, "Failed to copy engine-ids array from user\n");
> - kfree(engines);
> - return -EFAULT;
> + return PTR_ERR(engines);
> }
>
> rc = hdev->asic_funcs->set_engines(hdev, engines, num_engines, command);
> @@ -3013,7 +3005,6 @@ static int hl_multi_cs_wait_ioctl(struct hl_fpriv *hpriv, void *data)
> struct hl_ctx *ctx = hpriv->ctx;
> struct hl_fence **fence_arr;
> void __user *seq_arr;
> - u32 size_to_copy;
> u64 *cs_seq_arr;
> u8 seq_arr_len;
> int rc, i;
> @@ -3037,19 +3028,12 @@ static int hl_multi_cs_wait_ioctl(struct hl_fpriv *hpriv, void *data)
> return -EINVAL;
> }
>
> - /* allocate memory for sequence array */
> - cs_seq_arr =
> - kmalloc_array(seq_arr_len, sizeof(*cs_seq_arr), GFP_KERNEL);
> - if (!cs_seq_arr)
> - return -ENOMEM;
> -
> /* copy CS sequence array from user */
> seq_arr = (void __user *) (uintptr_t) args->in.seq;
> - size_to_copy = seq_arr_len * sizeof(*cs_seq_arr);
> - if (copy_from_user(cs_seq_arr, seq_arr, size_to_copy)) {
> + cs_seq_arr = memdup_array_user(seq_arr, seq_arr_len, sizeof(*cs_seq_arr));
> + if (IS_ERR(cs_seq_arr)) {
> dev_err(hdev->dev, "Failed to copy multi-cs sequence array from user\n");
> - rc = -EFAULT;
> - goto free_seq_arr;
> + return PTR_ERR(cs_seq_arr);
> }
>
> /* allocate array for the fences */