Re: [PATCH v2 2/3] drm/xe: revamp hw reserved PAT index checking

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/xe: speculative out-of-bounds read in xe_pat_index_get_coh_mode() via madvise
--

commit a69fb578f40c8fdf51d5e718f8df4b1bc5df612f
Author: Matthew Auld <matthew.auld@intel.com>

drm/xe: revamp hw reserved PAT index checking

This commit changes how PAT index validity is verified. It introduces
xe_pat_index_is_valid() and updates xe_pat_index_get_coh_mode() to validate
the coherency mode directly from the PAT table instead of relying on the caller.

> diff --git a/drivers/gpu/drm/xe/xe_pat.c b/drivers/gpu/drm/xe/xe_pat.c
> index 18e26f04169ab..d0dac1ebd4784 100644
> --- a/drivers/gpu/drm/xe/xe_pat.c
> +++ b/drivers/gpu/drm/xe/xe_pat.c
> @@ -294,9 +294,17 @@ static const struct xe_pat_table_entry xe3p_lpg_pat_table[] = {
>  	[31] = XE2_PAT( 0, 0, 3, 0, 3, 3 ),
>  };
>  
> +bool xe_pat_index_is_valid(struct xe_device *xe, u16 pat_index)
> +{
> +	WARN_ON(pat_index >= xe->pat.n_entries);
> +	return xe->pat.table[pat_index].valid;
> +}
> +
>  u16 xe_pat_index_get_coh_mode(struct xe_device *xe, u16 pat_index)
>  {
>  	WARN_ON(pat_index >= xe->pat.n_entries);
> +	WARN_ON(!xe->pat.table[pat_index].coh_mode ||
> +		xe->pat.table[pat_index].coh_mode > XE_COH_2WAY);

[Severity: Medium]
Could this new check introduce a speculative out-of-bounds array access?

If the bounds check WARN_ON(pat_index >= xe->pat.n_entries) is speculatively
mispredicted, the CPU might execute the read of
xe->pat.table[pat_index].coh_mode using an out-of-bounds index.

This seems reachable with an unmitigated user-controlled index via the
madvise ioctl. While xe_vm_madvise_ioctl() mitigates the index for the first
part of its validation, it then passes the raw user input to
check_pat_args_are_sane():

drivers/gpu/drm/xe/xe_vm_madvise.c:xe_vm_madvise_ioctl() {
    ...
    if (args->type == DRM_XE_MEM_RANGE_ATTR_PAT) {
        pat_index = array_index_nospec(args->pat_index.val,
                                       xe->pat.n_entries);
        ...
    }

    if (args->type == DRM_XE_MEM_RANGE_ATTR_PAT) {
        if (!check_pat_args_are_sane(xe, &madvise_range,
                                     args->pat_index.val)) {
    ...
}

The check_pat_args_are_sane() function then forwards this unmitigated index
to xe_pat_index_get_coh_mode().

>  	return xe->pat.table[pat_index].coh_mode;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015154553.483229-5-matthew.auld@intel.com?part=2