Proxmox-Port/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-09-01 09:36:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

drm/xe: Validate user fence during creation

Browse Source 
Fail invalid addresses during user fence creation.

Fixes: dd08ebf6c3 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240717140429.1396820-1-matthew.brost@intel.com
This commit is contained in:
Matthew Brost 2024-07-17 07:04:28 -07:00
parent 275aa53f59
commit 0fde907da2
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/gpu/drm/xe/xe_sync.c
View File

@ -53,14 +53,18 @@ static struct xe_user_fence *user_fence_create(struct xe_device *xe, u64 addr,
u64 value) u64 value)
{ {
struct xe_user_fence *ufence; struct xe_user_fence *ufence;
u64 __user *ptr = u64_to_user_ptr(addr);
if (!access_ok(ptr, sizeof(ptr)))
return ERR_PTR(-EFAULT);
ufence = kmalloc(sizeof(*ufence), GFP_KERNEL); ufence = kmalloc(sizeof(*ufence), GFP_KERNEL);
if (!ufence) if (!ufence)
return NULL; return ERR_PTR(-ENOMEM);
ufence->xe = xe; ufence->xe = xe;
kref_init(&ufence->refcount); kref_init(&ufence->refcount);
ufence->addr = u64_to_user_ptr(addr); ufence->addr = ptr;
ufence->value = value; ufence->value = value;
ufence->mm = current->mm; ufence->mm = current->mm;
mmgrab(ufence->mm); mmgrab(ufence->mm);
@ -183,8 +187,8 @@ int xe_sync_entry_parse(struct xe_device *xe, struct xe_file *xef,
} else { } else {
sync->ufence = user_fence_create(xe, sync_in.addr, sync->ufence = user_fence_create(xe, sync_in.addr,
sync_in.timeline_value); sync_in.timeline_value);
if (XE_IOCTL_DBG(xe, !sync->ufence)) if (XE_IOCTL_DBG(xe, IS_ERR(sync->ufence)))
return -ENOMEM; return PTR_ERR(sync->ufence);
} }
break; break;