On Tue, Feb 24, 2026 at 4:11 AM Sunil Khatri <[email protected]> wrote: > > Huge input values in amdgpu_userq_wait_ioctl can lead to a OOM and > could be exploited. > > So check these input value against AMDGPU_USERQ_MAX_HANDLES > which is big enough value for genuine use cases and could > potentially avoid OOM. > > Signed-off-by: Sunil Khatri <[email protected]>
Series is: Reviewed-by: Alex Deucher <[email protected]> > --- > drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > index 4f9386677c47..e31b2c6cc73b 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c > @@ -636,6 +636,12 @@ int amdgpu_userq_wait_ioctl(struct drm_device *dev, void > *data, > if (!amdgpu_userq_enabled(dev)) > return -ENOTSUPP; > > + if (wait_info->num_syncobj_handles > AMDGPU_USERQ_MAX_HANDLES || > + wait_info->num_syncobj_timeline_handles > > AMDGPU_USERQ_MAX_HANDLES || > + wait_info->num_bo_write_handles > AMDGPU_USERQ_MAX_HANDLES || > + wait_info->num_bo_read_handles > AMDGPU_USERQ_MAX_HANDLES) > + return -EINVAL; > + > num_syncobj = wait_info->num_syncobj_handles; > syncobj_handles = > memdup_array_user(u64_to_user_ptr(wait_info->syncobj_handles), > num_syncobj, sizeof(u32)); > -- > 2.34.1 >
