* [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count
@ 2026-08-04 16:00 Osama Abdelkader
2026-08-05 7:51 ` Boris Brezillon
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Osama Abdelkader @ 2026-08-04 16:00 UTC (permalink / raw)
To: Boris Brezillon, Steven Price, Liviu Dudau, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
Heiko Stuebner, dri-devel, linux-kernel
Cc: Osama Abdelkader, stable, sashiko-bot
In panthor_drv.c:panthor_ioctl_group_create(),
the queue count is validated against the hardcoded maximum:
if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)
return -EINVAL;
However, if the firmware reports fewer slots than MAX_CS_PER_CSG,
panthor_fw_init_ifaces() will only initialize that smaller number of
stream interfaces.
If unprivileged userspace requests more queues than the firmware reported
(but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an
uninitialized stream interface and may crash when dereferencing
cs_iface->input->ringbuf_base.
Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Closes: https://sashiko.dev/#/patchset/20260803141149.68182-1-osama.abdelkader@gmail.com?part=1
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
---
drivers/gpu/drm/panthor/panthor_sched.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index 5832dccfc093..64749750e6ee 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -3673,6 +3673,9 @@ int panthor_group_create(struct panthor_file *pfile,
hweight64(group_args->tiler_core_mask) < group_args->max_tiler_cores)
return -EINVAL;
+ if (group_args->queues.count > sched->cs_slot_count)
+ return -EINVAL;
+
group = kzalloc_obj(*group);
if (!group)
return -ENOMEM;
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count
2026-08-04 16:00 [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count Osama Abdelkader
@ 2026-08-05 7:51 ` Boris Brezillon
2026-08-05 9:43 ` Liviu Dudau
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Boris Brezillon @ 2026-08-05 7:51 UTC (permalink / raw)
To: Osama Abdelkader
Cc: Steven Price, Liviu Dudau, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Heiko Stuebner,
dri-devel, linux-kernel, stable, sashiko-bot
On Tue, 4 Aug 2026 18:00:47 +0200
Osama Abdelkader <osama.abdelkader@gmail.com> wrote:
> In panthor_drv.c:panthor_ioctl_group_create(),
> the queue count is validated against the hardcoded maximum:
>
> if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)
> return -EINVAL;
>
> However, if the firmware reports fewer slots than MAX_CS_PER_CSG,
> panthor_fw_init_ifaces() will only initialize that smaller number of
> stream interfaces.
>
> If unprivileged userspace requests more queues than the firmware reported
> (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an
> uninitialized stream interface and may crash when dereferencing
> cs_iface->input->ringbuf_base.
>
> Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
> Cc: stable@vger.kernel.org
> Reported-by: sashiko-bot@kernel.org
> Closes: https://sashiko.dev/#/patchset/20260803141149.68182-1-osama.abdelkader@gmail.com?part=1
> Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
> ---
> drivers/gpu/drm/panthor/panthor_sched.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
> index 5832dccfc093..64749750e6ee 100644
> --- a/drivers/gpu/drm/panthor/panthor_sched.c
> +++ b/drivers/gpu/drm/panthor/panthor_sched.c
> @@ -3673,6 +3673,9 @@ int panthor_group_create(struct panthor_file *pfile,
> hweight64(group_args->tiler_core_mask) < group_args->max_tiler_cores)
> return -EINVAL;
>
> + if (group_args->queues.count > sched->cs_slot_count)
> + return -EINVAL;
> +
> group = kzalloc_obj(*group);
> if (!group)
> return -ENOMEM;
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count
2026-08-04 16:00 [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count Osama Abdelkader
2026-08-05 7:51 ` Boris Brezillon
@ 2026-08-05 9:43 ` Liviu Dudau
2026-09-30 15:45 ` Steven Price
2026-09-30 16:07 ` Liviu Dudau
3 siblings, 0 replies; 6+ messages in thread
From: Liviu Dudau @ 2026-08-05 9:43 UTC (permalink / raw)
To: Osama Abdelkader
Cc: Boris Brezillon, Steven Price, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Heiko Stuebner,
dri-devel, linux-kernel, stable, sashiko-bot
On Tue, Aug 04, 2026 at 06:00:47PM +0200, Osama Abdelkader wrote:
> In panthor_drv.c:panthor_ioctl_group_create(),
> the queue count is validated against the hardcoded maximum:
>
> if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)
> return -EINVAL;
>
> However, if the firmware reports fewer slots than MAX_CS_PER_CSG,
> panthor_fw_init_ifaces() will only initialize that smaller number of
> stream interfaces.
>
> If unprivileged userspace requests more queues than the firmware reported
> (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an
> uninitialized stream interface and may crash when dereferencing
> cs_iface->input->ringbuf_base.
>
> Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
> Cc: stable@vger.kernel.org
> Reported-by: sashiko-bot@kernel.org
> Closes: https://sashiko.dev/#/patchset/20260803141149.68182-1-osama.abdelkader@gmail.com?part=1
> Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Best regards,
Liviu
> ---
> drivers/gpu/drm/panthor/panthor_sched.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
> index 5832dccfc093..64749750e6ee 100644
> --- a/drivers/gpu/drm/panthor/panthor_sched.c
> +++ b/drivers/gpu/drm/panthor/panthor_sched.c
> @@ -3673,6 +3673,9 @@ int panthor_group_create(struct panthor_file *pfile,
> hweight64(group_args->tiler_core_mask) < group_args->max_tiler_cores)
> return -EINVAL;
>
> + if (group_args->queues.count > sched->cs_slot_count)
> + return -EINVAL;
> +
> group = kzalloc_obj(*group);
> if (!group)
> return -ENOMEM;
> --
> 2.43.0
>
--
====================
| I would like to |
| fix the world, |
| but they're not |
| giving me the |
\ source code! /
---------------
¯\_(ツ)_/¯
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count
2026-08-04 16:00 [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count Osama Abdelkader
2026-08-05 7:51 ` Boris Brezillon
2026-08-05 9:43 ` Liviu Dudau
@ 2026-09-30 15:45 ` Steven Price
2026-09-30 16:07 ` Liviu Dudau
3 siblings, 0 replies; 6+ messages in thread
From: Steven Price @ 2026-09-30 15:45 UTC (permalink / raw)
To: Osama Abdelkader, Boris Brezillon, Liviu Dudau, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
Heiko Stuebner, dri-devel, linux-kernel
Cc: stable, sashiko-bot
On 04/08/2026 17:00, Osama Abdelkader wrote:
> In panthor_drv.c:panthor_ioctl_group_create(),
> the queue count is validated against the hardcoded maximum:
>
> if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)
> return -EINVAL;
>
> However, if the firmware reports fewer slots than MAX_CS_PER_CSG,
> panthor_fw_init_ifaces() will only initialize that smaller number of
> stream interfaces.
>
> If unprivileged userspace requests more queues than the firmware reported
> (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an
> uninitialized stream interface and may crash when dereferencing
> cs_iface->input->ringbuf_base.
>
> Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
> Cc: stable@vger.kernel.org
> Reported-by: sashiko-bot@kernel.org
> Closes: https://sashiko.dev/#/patchset/20260803141149.68182-1-osama.abdelkader@gmail.com?part=1
> Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Looks like this one got missed - I'll push it to drm-misc-fixes.
Thanks,
Steve
> ---
> drivers/gpu/drm/panthor/panthor_sched.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
> index 5832dccfc093..64749750e6ee 100644
> --- a/drivers/gpu/drm/panthor/panthor_sched.c
> +++ b/drivers/gpu/drm/panthor/panthor_sched.c
> @@ -3673,6 +3673,9 @@ int panthor_group_create(struct panthor_file *pfile,
> hweight64(group_args->tiler_core_mask) < group_args->max_tiler_cores)
> return -EINVAL;
>
> + if (group_args->queues.count > sched->cs_slot_count)
> + return -EINVAL;
> +
> group = kzalloc_obj(*group);
> if (!group)
> return -ENOMEM;
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count
2026-08-04 16:00 [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count Osama Abdelkader
` (2 preceding siblings ...)
2026-09-30 15:45 ` Steven Price
@ 2026-09-30 16:07 ` Liviu Dudau
3 siblings, 0 replies; 6+ messages in thread
From: Liviu Dudau @ 2026-09-30 16:07 UTC (permalink / raw)
To: Osama Abdelkader
Cc: Boris Brezillon, Steven Price, Maarten Lankhorst, Maxime Ripard,
Thomas Zimmermann, David Airlie, Simona Vetter, Heiko Stuebner,
dri-devel, linux-kernel, stable, sashiko-bot
On Tue, Aug 04, 2026 at 06:00:47PM +0200, Osama Abdelkader wrote:
> In panthor_drv.c:panthor_ioctl_group_create(),
> the queue count is validated against the hardcoded maximum:
>
> if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)
> return -EINVAL;
>
> However, if the firmware reports fewer slots than MAX_CS_PER_CSG,
> panthor_fw_init_ifaces() will only initialize that smaller number of
> stream interfaces.
>
> If unprivileged userspace requests more queues than the firmware reported
> (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an
> uninitialized stream interface and may crash when dereferencing
> cs_iface->input->ringbuf_base.
>
> Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
> Cc: stable@vger.kernel.org
> Reported-by: sashiko-bot@kernel.org
> Closes: https://sashiko.dev/#/patchset/20260803141149.68182-1-osama.abdelkader@gmail.com?part=1
> Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Sorry for the delay caused by holidays and other things, this patch has now been merged.
Best regards,
Liviu
> ---
> drivers/gpu/drm/panthor/panthor_sched.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
> index 5832dccfc093..64749750e6ee 100644
> --- a/drivers/gpu/drm/panthor/panthor_sched.c
> +++ b/drivers/gpu/drm/panthor/panthor_sched.c
> @@ -3673,6 +3673,9 @@ int panthor_group_create(struct panthor_file *pfile,
> hweight64(group_args->tiler_core_mask) < group_args->max_tiler_cores)
> return -EINVAL;
>
> + if (group_args->queues.count > sched->cs_slot_count)
> + return -EINVAL;
> +
> group = kzalloc_obj(*group);
> if (!group)
> return -ENOMEM;
> --
> 2.43.0
>
--
====================
| I would like to |
| fix the world, |
| but they're not |
| giving me the |
\ source code! /
---------------
¯\_(ツ)_/¯
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count
2026-10-12 15:30 FAILED: patch "[PATCH] drm/panthor: validate userspace queue count against" failed to apply to 6.18-stable tree gregkh
@ 2026-10-12 20:51 ` Liviu Dudau
0 siblings, 0 replies; 6+ messages in thread
From: Liviu Dudau @ 2026-10-12 20:51 UTC (permalink / raw)
To: stable; +Cc: Osama Abdelkader, sashiko-bot, Steven Price, Boris Brezillon
From: Osama Abdelkader <osama.abdelkader@gmail.com>
In panthor_drv.c:panthor_ioctl_group_create(),
the queue count is validated against the hardcoded maximum:
if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG)
return -EINVAL;
However, if the firmware reports fewer slots than MAX_CS_PER_CSG,
panthor_fw_init_ifaces() will only initialize that smaller number of
stream interfaces.
If unprivileged userspace requests more queues than the firmware reported
(but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an
uninitialized stream interface and may crash when dereferencing
cs_iface->input->ringbuf_base.
Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Closes: https://sashiko.dev/#/patchset/20260803141149.68182-1-osama.abdelkader@gmail.com?part=1
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Link: https://patch.msgid.link/20260804160048.174148-1-osama.abdelkader@gmail.com
Signed-off-by: Steven Price <steven.price@arm.com>
(cherry picked from commit ec86c43dcfff68eab4db9bdafcd3e2b16e342e18)
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
---
drivers/gpu/drm/panthor/panthor_sched.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index 85e24ca474484..08008a667b1bd 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -3549,6 +3549,9 @@ int panthor_group_create(struct panthor_file *pfile,
hweight64(group_args->tiler_core_mask) < group_args->max_tiler_cores)
return -EINVAL;
+ if (group_args->queues.count > sched->cs_slot_count)
+ return -EINVAL;
+
group = kzalloc(sizeof(*group), GFP_KERNEL);
if (!group)
return -ENOMEM;
--
2.55.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-12 20:51 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-04 16:00 [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count Osama Abdelkader
2026-08-05 7:51 ` Boris Brezillon
2026-08-05 9:43 ` Liviu Dudau
2026-09-30 15:45 ` Steven Price
2026-09-30 16:07 ` Liviu Dudau
-- strict thread matches above, loose matches on Subject: below --
2026-10-12 15:30 FAILED: patch "[PATCH] drm/panthor: validate userspace queue count against" failed to apply to 6.18-stable tree gregkh
2026-10-12 20:51 ` [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count Liviu Dudau
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.