Re: [PATCH v2 3/3] drm/xe/pat: always check is_valid() when querying an index

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/xe: speculative OOB read via unmitigated pat_index in madvise ioctl
--

commit 9ef2350e60afb2ff1710835baa5a7f21be86bd9c
Author: Matthew Auld <matthew.auld@intel.com>

drm/xe/pat: always check is_valid() when querying an index

This commit makes the behavior consistent by treating unknown indices as
programmer errors when extracting comp or l3, similar to coh_mode.

> diff --git a/drivers/gpu/drm/xe/xe_pat.c b/drivers/gpu/drm/xe/xe_pat.c
> index d0dac1ebd4784..9ab8fab43a884 100644
> --- a/drivers/gpu/drm/xe/xe_pat.c
> +++ b/drivers/gpu/drm/xe/xe_pat.c
> @@ -302,7 +302,7 @@ bool xe_pat_index_is_valid(struct xe_device *xe, u16 pat_index)
>  
>  u16 xe_pat_index_get_coh_mode(struct xe_device *xe, u16 pat_index)
>  {
> -	WARN_ON(pat_index >= xe->pat.n_entries);
> +	WARN_ON(!xe_pat_index_is_valid(xe, pat_index));

[Severity: High]
Does this WARN_ON() allow a speculative out-of-bounds read?

When xe_vm_madvise_ioctl() passes an unmitigated user value args->pat_index.val
into check_pat_args_are_sane():

xe_vm_madvise_ioctl() {
	...
	if (args->type == DRM_XE_MEM_RANGE_ATTR_PAT) {
		if (!check_pat_args_are_sane(xe, &madvise_range,
					     args->pat_index.val)) {
	...
}

It bypasses the array_index_nospec() mitigation computed earlier in the same
function. check_pat_args_are_sane() then calls xe_pat_index_get_coh_mode(),
which now invokes xe_pat_index_is_valid():

xe_pat_index_is_valid() {
	WARN_ON(pat_index >= xe->pat.n_entries);
	return xe->pat.table[pat_index].valid;
}

Since WARN_ON() does not return early on failure, could an unmitigated
speculative index cause a speculative out-of-bounds read on
xe->pat.table[pat_index]?

The loaded values are then used in branching logic (if (coh_mode != XE_COH_NONE)),
which might create a speculative disclosure gadget reachable by an unprivileged
user.

>  	WARN_ON(!xe->pat.table[pat_index].coh_mode ||
>  		xe->pat.table[pat_index].coh_mode > XE_COH_2WAY);
>  	return xe->pat.table[pat_index].coh_mode;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015154553.483229-5-matthew.auld@intel.com?part=3