openbsd/src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2026-05-01 17:46:35 +00:00
Code Issues Projects Releases Wiki Activity

drm/amdgpu: add upper bound check on user inputs in wait ioctl

Browse Source 
From Sunil Khatri
b1d10508da559da2e0ca9cca6505094a7df948e1 in linux-6.18.y/6.18.19
64ac7c09fc44985ec9bb6a9db740899fa40ca613 in mainline linux
This commit is contained in:
jsg
2026-03-20 00:07:44 +00:00
parent cb74c4842c
commit 146ab64e54
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
sys/dev/pci/drm/amd/amdgpu/amdgpu_userq_fence.c
View File

@@ -696,6 +696,11 @@ int amdgpu_userq_wait_ioctl(struct drm_device *dev, void *data,
if (!amdgpu_userq_enabled(dev))
return -ENOTSUPP;
if (wait_info->num_syncobj_handles > AMDGPU_USERQ_MAX_HANDLES ||
wait_info->num_bo_write_handles > AMDGPU_USERQ_MAX_HANDLES ||
wait_info->num_bo_read_handles > AMDGPU_USERQ_MAX_HANDLES)
return -EINVAL;
num_read_bo_handles = wait_info->num_bo_read_handles;
bo_handles_read = memdup_user(u64_to_user_ptr(wait_info->bo_read_handles),
size_mul(sizeof(u32), num_read_bo_handles));