amdgpu_gem_ualink_handle_ioctl() dereferences adev->ualink.info before
validating it, but that structure is only allocated when the UALink IP
block is present, which is currently added only for GFX 12.1 only. The
ioctl is registered for every amdgpu device with DRM_RENDER_ALLOW, so
on any other ASIC a render node user can oops the kernel with a single
call.
Return -EOPNOTSUPP when the UALink software state is absent.
Fixes: 8a8bb5cb0410 ("drm/amdgpu: Add ioctl infra for exporting/importing
UALink handles")
Reported-by: Sashiko-bot <[email protected]>
Signed-off-by: Mukul Joshi <[email protected]>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
index 8411ea17172f..3d84f5a7a34d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ualink.c
@@ -4072,6 +4072,13 @@ int amdgpu_gem_ualink_handle_ioctl(struct drm_device
*dev, void *data,
u32 gem_handle;
int r, fd = -1;
+ /* The ioctl is registered for every amdgpu device, but the UALink
+ * software state only exists on ASICs that instantiate the UALink IP
+ * block.
+ */
+ if (!adev->ualink.info)
+ return -EOPNOTSUPP;
+
if (adev->ualink.info->accel_state !=
AMDGPU_UALINK_ACCEL_STATE_ACTIVE) {
dev_err(adev->dev,
--
2.55.0
