From: Paulo Zanoni Date: Mon, 26 Jun 2023 21:22:21 +0000 (-0700) Subject: drm/xe: properly check bounds for xe_wait_user_fence_ioctl() X-Git-Tag: v6.8-rc1~21^2~13^2~580 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=2e60442a4fef935c76cd70858775b92f565642cc;p=linux-block.git drm/xe: properly check bounds for xe_wait_user_fence_ioctl() If !no_engines, then we use copy_from_user to copy to the 'eci' array, which has XE_HW_ENGINE_MAX_INSTANCE members. The amount of members copied is given by the user in args->num_engines, so add code to check that args->num_engines does not exceed XE_HW_ENGINE_MAX_INSTANCE. It's an unsigned value so there's no need to check for negative values. Fixes error messages such as: Buffer overflow detected (54 < 18446744073709551520)! Reviewed-by: José Roberto de Souza Signed-off-by: Paulo Zanoni Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20230626212221.136640-2-paulo.r.zanoni@intel.com Signed-off-by: Lucas De Marchi Signed-off-by: Rodrigo Vivi --- diff --git a/drivers/gpu/drm/xe/xe_wait_user_fence.c b/drivers/gpu/drm/xe/xe_wait_user_fence.c index 3122374341d6..098e2a4cff3f 100644 --- a/drivers/gpu/drm/xe/xe_wait_user_fence.c +++ b/drivers/gpu/drm/xe/xe_wait_user_fence.c @@ -121,6 +121,9 @@ int xe_wait_user_fence_ioctl(struct drm_device *dev, void *data, addr & 0x7)) return -EINVAL; + if (XE_IOCTL_ERR(xe, args->num_engines > XE_HW_ENGINE_MAX_INSTANCE)) + return -EINVAL; + if (!no_engines) { err = copy_from_user(eci, user_eci, sizeof(struct drm_xe_engine_class_instance) *