tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/amdgpu: validate doorbell_offset in user queue creation

amdgpu_userq_get_doorbell_index() passes the user-provided
doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds
checking. An arbitrarily large doorbell_offset can cause the
calculated doorbell index to fall outside the allocated doorbell BO,
potentially corrupting kernel doorbell space.

Validate that doorbell_offset falls within the doorbell BO before
computing the BAR index, using u64 arithmetic to prevent overflow.

Fixes: f09c1e6077ab ("drm/amdgpu: generate doorbell index for userqueue")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

authored by

Junrui Luo and committed by
Alex Deucher de1ef4ff a51973c5

+7
+7
drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c
··· 600 600 goto unpin_bo; 601 601 } 602 602 603 + /* Validate doorbell_offset is within the doorbell BO */ 604 + if ((u64)db_info->doorbell_offset * db_size + db_size > 605 + amdgpu_bo_size(db_obj->obj)) { 606 + r = -EINVAL; 607 + goto unpin_bo; 608 + } 609 + 603 610 index = amdgpu_doorbell_index_on_bar(uq_mgr->adev, db_obj->obj, 604 611 db_info->doorbell_offset, db_size); 605 612 drm_dbg_driver(adev_to_drm(uq_mgr->adev),