Applied. Thanks!
On Tue, Apr 22, 2025 at 5:13 AM Koenig, Christian <[email protected]> wrote: > > [AMD Official Use Only - AMD Internal Distribution Only] > > Reviewed-by: Christian König <[email protected]> > > ________________________________________ > Von: Denis Arefev <[email protected]> > Gesendet: Freitag, 18. April 2025 10:31 > An: Deucher, Alexander > Cc: Koenig, Christian; David Airlie; Simona Vetter; Andrey Grodzovsky; > Chunming Zhou; [email protected]; > [email protected]; [email protected]; > [email protected]; [email protected] > Betreff: [PATCH v2] drm/amdgpu: check a user-provided number of BOs in list > > The user can set any value to the variable ‘bo_number’, via the ioctl > command DRM_IOCTL_AMDGPU_BO_LIST. This will affect the arithmetic > expression ‘in->bo_number * in->bo_info_size’, which is prone to > overflow. Add a valid value check. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 964d0fbf6301 ("drm/amdgpu: Allow to create BO lists in CS ioctl v3") > Cc: [email protected] > Signed-off-by: Denis Arefev <[email protected]> > --- > V1 -> V2: > Set a reasonable limit 'USHRT_MAX' for 'bo_number' it as Christian König > <[email protected]> suggested > > drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c > index 702f6610d024..85f7ee1e085d 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c > @@ -189,6 +189,9 @@ int amdgpu_bo_create_list_entry_array(struct > drm_amdgpu_bo_list_in *in, > struct drm_amdgpu_bo_list_entry *info; > int r; > > + if (!in->bo_number || in->bo_number > USHRT_MAX) > + return -EINVAL; > + > info = kvmalloc_array(in->bo_number, info_size, GFP_KERNEL); > if (!info) > return -ENOMEM; > -- > 2.43.0 >
