From: Sunil Khatri Date: Tue, 24 Feb 2026 06:43:09 +0000 (+0530) Subject: drm/amdgpu: add upper bound check on user inputs in wait ioctl X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fcec012c664247531aed3e662f4280ff804d1476;p=thirdparty%2Fkernel%2Flinux.git drm/amdgpu: add upper bound check on user inputs in wait ioctl Huge input values in amdgpu_userq_wait_ioctl can lead to a OOM and could be exploited. So check these input value against AMDGPU_USERQ_MAX_HANDLES which is big enough value for genuine use cases and could potentially avoid OOM. v2: squash in Srini's fix Signed-off-by: Sunil Khatri Reviewed-by: Christian König Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c index 10669a249b9f5..844c2db35e4a1 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c @@ -635,6 +635,11 @@ int amdgpu_userq_wait_ioctl(struct drm_device *dev, void *data, if (!amdgpu_userq_enabled(dev)) return -ENOTSUPP; + if (wait_info->num_syncobj_handles > AMDGPU_USERQ_MAX_HANDLES || + wait_info->num_bo_write_handles > AMDGPU_USERQ_MAX_HANDLES || + wait_info->num_bo_read_handles > AMDGPU_USERQ_MAX_HANDLES) + return -EINVAL; + num_syncobj = wait_info->num_syncobj_handles; syncobj_handles = memdup_array_user(u64_to_user_ptr(wait_info->syncobj_handles), num_syncobj, sizeof(u32));