openbsd/src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2026-05-01 09:37:02 +00:00
Code Issues Projects Releases Wiki Activity

drm/amdgpu: add upper bound check on user inputs in signal ioctl

Browse Source 
From Sunil Khatri
6fff5204d8aa26b1be50b6427f833bd3e8899c4f in linux-6.18.y/6.18.19
ea78f8c68f4f6211c557df49174c54d167821962 in mainline linux
This commit is contained in:
jsg
2026-03-20 00:02:55 +00:00
parent 78e474a414
commit 04c9db8ff7
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
sys/dev/pci/drm/amd/amdgpu/amdgpu_userq_fence.c
View File

@@ -35,6 +35,8 @@
static const struct dma_fence_ops amdgpu_userq_fence_ops;
static struct pool amdgpu_userq_fence_slab;
#define AMDGPU_USERQ_MAX_HANDLES (1U << 16)
int amdgpu_userq_fence_slab_init(void)
{
#ifdef __linux__
@@ -497,6 +499,11 @@ int amdgpu_userq_signal_ioctl(struct drm_device *dev, void *data,
if (!amdgpu_userq_enabled(dev))
return -ENOTSUPP;
if (args->num_syncobj_handles > AMDGPU_USERQ_MAX_HANDLES ||
args->num_bo_write_handles > AMDGPU_USERQ_MAX_HANDLES ||
args->num_bo_read_handles > AMDGPU_USERQ_MAX_HANDLES)
return -EINVAL;
num_syncobj_handles = args->num_syncobj_handles;
syncobj_handles = memdup_user(u64_to_user_ptr(args->syncobj_handles),
size_mul(sizeof(u32), num_syncobj_handles));