drm/amdgpu: add upper bound check on user inputs in wait ioctl

Huge input values in amdgpu_userq_wait_ioctl can lead to a OOM and
could be exploited.

So check these input value against AMDGPU_USERQ_MAX_HANDLES
which is big enough value for genuine use cases and could
potentially avoid OOM.

v2: squash in Srini's fix

Signed-off-by: Sunil Khatri <sunil.khatri@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
index 10669a249b9f5e7a80e3f3f3c71d2fe0e5acffc4..844c2db35e4a17be9f8e15aa9a1c44c1acb2cb18 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
@@ -635,6 +635,11 @@ int amdgpu_userq_wait_ioctl(struct drm_device *dev, void *data,
        if (!amdgpu_userq_enabled(dev))
                return -ENOTSUPP;
 
+       if (wait_info->num_syncobj_handles > AMDGPU_USERQ_MAX_HANDLES ||
+           wait_info->num_bo_write_handles > AMDGPU_USERQ_MAX_HANDLES ||
+           wait_info->num_bo_read_handles > AMDGPU_USERQ_MAX_HANDLES)
+               return -EINVAL;
+
        num_syncobj = wait_info->num_syncobj_handles;
        syncobj_handles = memdup_array_user(u64_to_user_ptr(wait_info->syncobj_handles),
                                            num_syncobj, sizeof(u32));