On 4/22/25 18:26, Deucher, Alexander wrote: > [Public] > >> -----Original Message----- >> From: Alex Deucher <[email protected]> >> Sent: Tuesday, April 22, 2025 9:46 AM >> To: Koenig, Christian <[email protected]> >> Cc: Denis Arefev <[email protected]>; Deucher, Alexander >> <[email protected]>; David Airlie <[email protected]>; Simona Vetter >> <[email protected]>; Andrey Grodzovsky <[email protected]>; >> Chunming Zhou <[email protected]>; [email protected]; dri- >> [email protected]; [email protected]; lvc- >> [email protected]; [email protected] >> Subject: Re: [PATCH v2] drm/amdgpu: check a user-provided number of BOs in >> list >> >> Applied. Thanks! > > This change beaks the following IGT tests: > > igt@amdgpu/amd_vcn@vcn-decoder-create-decode-destroy@vcn-decoder-create > igt@amdgpu/amd_vcn@vcn-decoder-create-decode-destroy@vcn-decoder-decode > igt@amdgpu/amd_vcn@vcn-decoder-create-decode-destroy@vcn-decoder-destroy > igt@amdgpu/amd_jpeg_dec@amdgpu_cs_jpeg_decode > igt@amdgpu/amd_cs_nop@cs-nops-with-nop-compute0@cs-nop-with-nop-compute0 > igt@amdgpu/amd_cs_nop@cs-nops-with-sync-compute0@cs-nop-with-sync-compute0 > igt@amdgpu/amd_cs_nop@cs-nops-with-fork-compute0@cs-nop-with-fork-compute0 > igt@amdgpu/amd_cs_nop@cs-nops-with-sync-fork-compute0@cs-nop-with-sync-fork-compute0 > igt@amdgpu/amd_basic@userptr-with-ip-dma@userptr > igt@amdgpu/amd_basic@cs-compute-with-ip-compute@cs-compute > igt@amdgpu/amd_basic@cs-sdma-with-ip-dma@cs-sdma > igt@amdgpu/amd_basic@eviction-test-with-ip-dma@eviction_test > igt@amdgpu/amd_cp_dma_misc@gtt_to_vram-amdgpu_hw_ip_compute0 > igt@amdgpu/amd_cp_dma_misc@vram_to_gtt-amdgpu_hw_ip_compute0 > igt@amdgpu/amd_cp_dma_misc@vram_to_vram-amdgpu_hw_ip_compute0
Could it be that we used BO list with zero entries for those? Christian. > > Alex > >> >> On Tue, Apr 22, 2025 at 5:13 AM Koenig, Christian <[email protected]> >> wrote: >>> >>> [AMD Official Use Only - AMD Internal Distribution Only] >>> >>> Reviewed-by: Christian König <[email protected]> >>> >>> ________________________________________ >>> Von: Denis Arefev <[email protected]> >>> Gesendet: Freitag, 18. April 2025 10:31 >>> An: Deucher, Alexander >>> Cc: Koenig, Christian; David Airlie; Simona Vetter; Andrey Grodzovsky; >>> Chunming Zhou; [email protected]; >>> [email protected]; [email protected]; >>> [email protected]; [email protected] >>> Betreff: [PATCH v2] drm/amdgpu: check a user-provided number of BOs in >>> list >>> >>> The user can set any value to the variable ‘bo_number’, via the ioctl >>> command DRM_IOCTL_AMDGPU_BO_LIST. This will affect the arithmetic >>> expression ‘in->bo_number * in->bo_info_size’, which is prone to >>> overflow. Add a valid value check. >>> >>> Found by Linux Verification Center (linuxtesting.org) with SVACE. >>> >>> Fixes: 964d0fbf6301 ("drm/amdgpu: Allow to create BO lists in CS ioctl >>> v3") >>> Cc: [email protected] >>> Signed-off-by: Denis Arefev <[email protected]> >>> --- >>> V1 -> V2: >>> Set a reasonable limit 'USHRT_MAX' for 'bo_number' it as Christian >>> König <[email protected]> suggested >>> >>> drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 3 +++ >>> 1 file changed, 3 insertions(+) >>> >>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c >>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c >>> index 702f6610d024..85f7ee1e085d 100644 >>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c >>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c >>> @@ -189,6 +189,9 @@ int amdgpu_bo_create_list_entry_array(struct >> drm_amdgpu_bo_list_in *in, >>> struct drm_amdgpu_bo_list_entry *info; >>> int r; >>> >>> + if (!in->bo_number || in->bo_number > USHRT_MAX) >>> + return -EINVAL; >>> + >>> info = kvmalloc_array(in->bo_number, info_size, GFP_KERNEL); >>> if (!info) >>> return -ENOMEM; >>> -- >>> 2.43.0 >>>
