On 2/24/26 09:24, Sunil Khatri wrote: > Huge input values in amdgpu_userq_signal_ioctl can lead to a OOM and > could be exploited. > > So check these input value against AMDGPU_USERQ_MAX_HANDLES > which is big enough value for genuine use cases and could > potentially avoid OOM. > > Signed-off-by: Sunil Khatri <[email protected]>
In the long term we should probably move those checks into the DRM helpers for those objects. But for now: Reviewed-by: Christian König <[email protected]> > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > index 42b548c8a86e..4f9386677c47 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > @@ -35,6 +35,8 @@ > static const struct dma_fence_ops amdgpu_userq_fence_ops; > static struct kmem_cache *amdgpu_userq_fence_slab; > > +#define AMDGPU_USERQ_MAX_HANDLES (1U << 16) > + > int amdgpu_userq_fence_slab_init(void) > { > amdgpu_userq_fence_slab = kmem_cache_create("amdgpu_userq_fence", > @@ -478,6 +480,11 @@ int amdgpu_userq_signal_ioctl(struct drm_device *dev, > void *data, > if (!amdgpu_userq_enabled(dev)) > return -ENOTSUPP; > > + if (args->num_syncobj_handles > AMDGPU_USERQ_MAX_HANDLES || > + args->num_bo_write_handles > AMDGPU_USERQ_MAX_HANDLES || > + args->num_bo_read_handles > AMDGPU_USERQ_MAX_HANDLES) > + return -EINVAL; > + > num_syncobj_handles = args->num_syncobj_handles; > syncobj_handles = > memdup_array_user(u64_to_user_ptr(args->syncobj_handles), > num_syncobj_handles, sizeof(u32));
