Intel-XE Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 0/2]  Improve ufence addr validation and error handling
@ 2024-10-15  9:05 Nirmoy Das
  2024-10-15  9:05 ` [PATCH 1/2] drm/xe/ufence: Prefetch ufence addr to catch bogus address Nirmoy Das
                   ` (16 more replies)
  0 siblings, 17 replies; 21+ messages in thread
From: Nirmoy Das @ 2024-10-15  9:05 UTC (permalink / raw)
  To: intel-xe
  Cc: Nirmoy Das, Francois Dugast, Maarten Lankhorst, Matthew Auld,
	Matthew Brost

Resending https://patchwork.freedesktop.org/series/139887/ with 
Test-with tag to validate we catch bogus addr from userspace early.

Test-with: 20241014141839.1618518-1-nirmoy.das@intel.com
Cc: Francois Dugast <francois.dugast@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Nirmoy Das (2):
  drm/xe/ufence: Prefetch ufence addr to catch bogus address
  drm/xe/ufence: Warn if mmget_not_zero() fails

 drivers/gpu/drm/xe/xe_sync.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

-- 
2.46.0


^ permalink raw reply	[flat|nested] 21+ messages in thread
* [PATCH 1/2] drm/xe/ufence: Prefetch ufence addr to catch bogus address
@ 2024-10-11 11:57 Nirmoy Das
  0 siblings, 0 replies; 21+ messages in thread
From: Nirmoy Das @ 2024-10-11 11:57 UTC (permalink / raw)
  To: intel-xe; +Cc: Nirmoy Das, Matthew Brost

access_ok() only checks for addr overflow so also try to read the addr
to catch invalid addr sent from userspace.

Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/1630
Cc: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Nirmoy Das <nirmoy.das@intel.com>
---
 drivers/gpu/drm/xe/xe_sync.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_sync.c b/drivers/gpu/drm/xe/xe_sync.c
index bb3c2a830362..6a2e4dd41d56 100644
--- a/drivers/gpu/drm/xe/xe_sync.c
+++ b/drivers/gpu/drm/xe/xe_sync.c
@@ -54,8 +54,9 @@ static struct xe_user_fence *user_fence_create(struct xe_device *xe, u64 addr,
 {
 	struct xe_user_fence *ufence;
 	u64 __user *ptr = u64_to_user_ptr(addr);
+	u64 __maybe_unused prefetch_val;
 
-	if (!access_ok(ptr, sizeof(*ptr)))
+	if (get_user(prefetch_val, ptr))
 		return ERR_PTR(-EFAULT);
 
 	ufence = kmalloc(sizeof(*ufence), GFP_KERNEL);
-- 
2.46.0


^ permalink raw reply related	[flat|nested] 21+ messages in thread

end of thread, other threads:[~2024-10-16 13:56 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-15  9:05 [PATCH 0/2] Improve ufence addr validation and error handling Nirmoy Das
2024-10-15  9:05 ` [PATCH 1/2] drm/xe/ufence: Prefetch ufence addr to catch bogus address Nirmoy Das
2024-10-15  9:05 ` [PATCH 2/2] drm/xe/ufence: Warn if mmget_not_zero() fails Nirmoy Das
2024-10-15 12:48   ` Maarten Lankhorst
2024-10-15 12:59     ` Nirmoy Das
2024-10-15 12:46 ` ✓ CI.Patch_applied: success for Improve ufence addr validation and error handling Patchwork
2024-10-15 12:46 ` ✓ CI.checkpatch: " Patchwork
2024-10-15 12:48 ` ✓ CI.KUnit: " Patchwork
2024-10-15 12:59 ` ✓ CI.Build: " Patchwork
2024-10-15 13:01 ` ✓ CI.Hooks: " Patchwork
2024-10-15 13:03 ` ✓ CI.checksparse: " Patchwork
2024-10-15 21:14 ` ✗ CI.FULL: failure " Patchwork
2024-10-16  5:34 ` ✓ CI.Patch_applied: success for Improve ufence addr validation and error handling (rev2) Patchwork
2024-10-16  5:34 ` ✓ CI.checkpatch: " Patchwork
2024-10-16  5:35 ` ✓ CI.KUnit: " Patchwork
2024-10-16  5:47 ` ✓ CI.Build: " Patchwork
2024-10-16  5:49 ` ✓ CI.Hooks: " Patchwork
2024-10-16  5:51 ` ✓ CI.checksparse: " Patchwork
2024-10-16  6:15 ` ✓ CI.BAT: " Patchwork
2024-10-16 13:56 ` ✗ CI.FULL: failure " Patchwork
  -- strict thread matches above, loose matches on Subject: below --
2024-10-11 11:57 [PATCH 1/2] drm/xe/ufence: Prefetch ufence addr to catch bogus address Nirmoy Das

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox