Commit ea78f8c6 authored by Sunil Khatri's avatar Sunil Khatri Committed by Alex Deucher
Browse files

drm/amdgpu: add upper bound check on user inputs in signal ioctl 



Huge input values in amdgpu_userq_signal_ioctl can lead to a OOM and
could be exploited.

So check these input value against AMDGPU_USERQ_MAX_HANDLES
which is big enough value for genuine use cases and could
potentially avoid OOM.

Signed-off-by: default avatarSunil Khatri <sunil.khatri@amd.com>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
(cherry picked from commit be267e15)
Cc: stable@vger.kernel.org
parent 7b7d7693

drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c

+7 −0
Original line number Diff line number Diff line
@@ -35,6 +35,8 @@ 
static const struct dma_fence_ops amdgpu_userq_fence_ops;

static struct kmem_cache *amdgpu_userq_fence_slab;



#define AMDGPU_USERQ_MAX_HANDLES	(1U << 16)



int amdgpu_userq_fence_slab_init(void)

{

	amdgpu_userq_fence_slab = kmem_cache_create("amdgpu_userq_fence",
@@ -478,6 +480,11 @@ int amdgpu_userq_signal_ioctl(struct drm_device *dev, void *data, 
	if (!amdgpu_userq_enabled(dev))

		return -ENOTSUPP;



	if (args->num_syncobj_handles > AMDGPU_USERQ_MAX_HANDLES ||

	    args->num_bo_write_handles > AMDGPU_USERQ_MAX_HANDLES ||

	    args->num_bo_read_handles > AMDGPU_USERQ_MAX_HANDLES)

		return -EINVAL;



	num_syncobj_handles = args->num_syncobj_handles;

	syncobj_handles = memdup_user(u64_to_user_ptr(args->syncobj_handles),

				      size_mul(sizeof(u32), num_syncobj_handles));