- The RAS rcmd->output_size handling has latent bug where it may trigger a racing condition and overflow the VF kernel heap.
- Must use a dedicated variable to store the buffer size value and add a uppler boundary check Signed-off-by: Bokun Zhang <[email protected]> --- drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c | 9 ++++++--- drivers/gpu/drm/amd/ras/rascore/ras_cmd.h | 3 +++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c index 838eb91aef39..e73443b933dc 100644 --- a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c +++ b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c @@ -92,6 +92,7 @@ static int amdgpu_virt_ras_remote_ioctl_cmd(struct ras_core_context *ras_core, struct amdgpu_virt_ras_cmd *virt_ras = ras_mgr->virt_ras_cmd; uint32_t mem_len = ALIGN(sizeof(*cmd) + output_size, AMDGPU_GPU_PAGE_SIZE); struct ras_cmd_ctx *rcmd; + uint32_t rcmd_output_size; struct amdgpu_virt_shared_mem shared_mem = {0}; int ret = 0; @@ -113,10 +114,12 @@ static int amdgpu_virt_ras_remote_ioctl_cmd(struct ras_core_context *ras_core, goto out; } + rcmd_output_size = rcmd->output_size; + cmd->cmd_res = rcmd->cmd_res; - cmd->output_size = rcmd->output_size; - if (rcmd->output_size && (rcmd->output_size <= output_size) && output_data) - memcpy(output_data, rcmd->output_buff_raw, rcmd->output_size); + cmd->output_size = rcmd_output_size; + if (output_data && rcmd_output_size && (rcmd_output_size <= output_size) && (rcmd_output_size < RAS_CMD_MAX_BUF_SIZE)) + memcpy(output_data, rcmd->output_buff_raw, rcmd_output_size); } out: diff --git a/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h b/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h index 7ea35a028987..c7e8e84e2201 100644 --- a/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h +++ b/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h @@ -35,6 +35,9 @@ #define RAS_CMD_MAX_GPU_NUM 32 #define RAS_CMD_MAX_BAD_PAGES_PER_GROUP 32 +/* Size of cmd_buf in struct amd_sriov_uniras_shared_mem (AMD_SRIOV_UNIRAS_CMD_MAX_SIZE). */ +#define RAS_CMD_MAX_BUF_SIZE (4096 * 13) + /* position of instance value in sub_block_index of * ta_ras_trigger_error_input, the sub block uses lower 12 bits */ -- 2.51.0
