tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/amdgpu: add upper bound check on user inputs in signal ioctl

Huge input values in amdgpu_userq_signal_ioctl can lead to a OOM and
could be exploited.

So check these input value against AMDGPU_USERQ_MAX_HANDLES
which is big enough value for genuine use cases and could
potentially avoid OOM.

Signed-off-by: Sunil Khatri <sunil.khatri@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit be267e15f99bc97cbe202cd556717797cdcf79a5)
Cc: stable@vger.kernel.org

authored by

Sunil Khatri and committed by
Alex Deucher ea78f8c6 7b7d7693

+7
+7
drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
··· 35 35 static const struct dma_fence_ops amdgpu_userq_fence_ops; 36 36 static struct kmem_cache *amdgpu_userq_fence_slab; 37 37 38 + #define AMDGPU_USERQ_MAX_HANDLES (1U << 16) 39 + 38 40 int amdgpu_userq_fence_slab_init(void) 39 41 { 40 42 amdgpu_userq_fence_slab = kmem_cache_create("amdgpu_userq_fence", ··· 479 477 480 478 if (!amdgpu_userq_enabled(dev)) 481 479 return -ENOTSUPP; 480 + 481 + if (args->num_syncobj_handles > AMDGPU_USERQ_MAX_HANDLES || 482 + args->num_bo_write_handles > AMDGPU_USERQ_MAX_HANDLES || 483 + args->num_bo_read_handles > AMDGPU_USERQ_MAX_HANDLES) 484 + return -EINVAL; 482 485 483 486 num_syncobj_handles = args->num_syncobj_handles; 484 487 syncobj_handles = memdup_user(u64_to_user_ptr(args->syncobj_handles),