[PATCH 3/3] drm/xe/oa: Limit num_syncs to prevent oversized allocations

[Shuicheng Lin <shuicheng.lin@intel.com>]

The OA open parameters did not validate num_syncs, allowing
userspace to pass arbitrarily large values, potentially
leading to excessive allocations.

Add checks to ensure that num_syncs does not exceed XE_MAX_SYNCS,
returning -EINVAL when the limit is violated.

Fixes: c8507a25cebd ("drm/xe/oa/uapi: Define and parse OA sync properties")
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Ashutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
---
 drivers/gpu/drm/xe/xe_oa.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c
index cc48663c2b48..7477c27a4ba2 100644
--- a/drivers/gpu/drm/xe/xe_oa.c
+++ b/drivers/gpu/drm/xe/xe_oa.c
@@ -1254,6 +1254,11 @@ static int xe_oa_set_no_preempt(struct xe_oa *oa, u64 value,
 static int xe_oa_set_prop_num_syncs(struct xe_oa *oa, u64 value,
 				    struct xe_oa_open_param *param)
 {
+	if (value > XE_MAX_SYNCS) {
+		drm_dbg(&oa->xe->drm, "num_syncs %llu must be <= %u\n",
+			value, XE_MAX_SYNCS);
+		return -EINVAL;
+	}
 	param->num_syncs = value;
 	return 0;
 }
@@ -1404,6 +1409,12 @@ static int xe_oa_parse_syncs(struct xe_oa *oa,
 	}
 
 	if (param->num_syncs) {
+		if (param->num_syncs > XE_MAX_SYNCS) {
+			drm_dbg(&oa->xe->drm, "num_syncs %d must be <= %u\n",
+				param->num_syncs, XE_MAX_SYNCS);
+			ret = -EINVAL;
+			goto exit;
+		}
 		param->syncs = kcalloc(param->num_syncs, sizeof(*param->syncs), GFP_KERNEL);
 		if (!param->syncs) {
 			ret = -ENOMEM;
-- 
2.50.1