On 2/24/26 09:24, Sunil Khatri wrote:
> Huge input values in amdgpu_userq_signal_ioctl can lead to a OOM and
> could be exploited.
> 
> So check these input value against AMDGPU_USERQ_MAX_HANDLES
> which is big enough value for genuine use cases and could
> potentially avoid OOM.
> 
> Signed-off-by: Sunil Khatri <[email protected]>

In the long term we should probably move those checks into the DRM helpers for 
those objects. But for now:

Reviewed-by: Christian König <[email protected]>

> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c 
> b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
> index 42b548c8a86e..4f9386677c47 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
> @@ -35,6 +35,8 @@
>  static const struct dma_fence_ops amdgpu_userq_fence_ops;
>  static struct kmem_cache *amdgpu_userq_fence_slab;
>  
> +#define AMDGPU_USERQ_MAX_HANDLES     (1U << 16)
> +
>  int amdgpu_userq_fence_slab_init(void)
>  {
>       amdgpu_userq_fence_slab = kmem_cache_create("amdgpu_userq_fence",
> @@ -478,6 +480,11 @@ int amdgpu_userq_signal_ioctl(struct drm_device *dev, 
> void *data,
>       if (!amdgpu_userq_enabled(dev))
>               return -ENOTSUPP;
>  
> +     if (args->num_syncobj_handles > AMDGPU_USERQ_MAX_HANDLES ||
> +         args->num_bo_write_handles > AMDGPU_USERQ_MAX_HANDLES ||
> +         args->num_bo_read_handles > AMDGPU_USERQ_MAX_HANDLES)
> +             return -EINVAL;
> +
>       num_syncobj_handles = args->num_syncobj_handles;
>       syncobj_handles = 
> memdup_array_user(u64_to_user_ptr(args->syncobj_handles),
>                                           num_syncobj_handles, sizeof(u32));

Reply via email to