public inbox for intel-gfx@lists.freedesktop.org
 help / color / mirror / Atom feed
* [PATCH] drm/i915: Prevent  heap overflow in i915_l3_write()
@ 2026-01-28  5:11 Kaushlendra Kumar
  2026-01-28  7:06 ` ✓ i915.CI.BAT: success for " Patchwork
                   ` (2 more replies)
  0 siblings, 3 replies; 7+ messages in thread
From: Kaushlendra Kumar @ 2026-01-28  5:11 UTC (permalink / raw)
  To: jani.nikula, rodrigo.vivi, joonas.lahtinen; +Cc: intel-gfx, Kaushlendra Kumar

The i915_l3_write() function failed to validate that the write
count did not exceed the remaining buffer size after the starting
offset. This allows userspace to trigger a heap buffer overflow.

Clamp the write count to the remaining size of the L3 log buffer
to ensure memory safety.

Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
---
 drivers/gpu/drm/i915/i915_sysfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/i915/i915_sysfs.c b/drivers/gpu/drm/i915/i915_sysfs.c
index 70e0d8615160..3c592111d0cc 100644
--- a/drivers/gpu/drm/i915/i915_sysfs.c
+++ b/drivers/gpu/drm/i915/i915_sysfs.c
@@ -121,6 +121,7 @@ i915_l3_write(struct file *filp, struct kobject *kobj,
 	}
 
 	count = round_down(count, sizeof(u32));
+	count = min_t(size_t, GEN7_L3LOG_SIZE - offset, count);
 	memcpy(remap_info + offset / sizeof(u32), buf, count);
 
 	/* NB: We defer the remapping until we switch to the context */
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2026-03-23 15:01 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-28  5:11 [PATCH] drm/i915: Prevent heap overflow in i915_l3_write() Kaushlendra Kumar
2026-01-28  7:06 ` ✓ i915.CI.BAT: success for " Patchwork
2026-01-28 10:50 ` [PATCH] " Jani Nikula
2026-01-28 11:27   ` Kumar, Kaushlendra
2026-01-28 13:00     ` Jani Nikula
2026-03-23 15:00       ` Kumar, Kaushlendra
2026-01-28 14:16 ` ✗ i915.CI.Full: failure for " Patchwork

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox