Re: [PATCH v6 6/7] drm/xe/vf: Add bounds checking for queried VRAM size

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing upper bounds check for queried VRAM size
--

--- Patch [6]: [PATCH v6 6/7] drm/xe/vf: Add bounds checking for queried VRAM size ---
commit 2089489a65d04a75b7e07c3d3903caf61610c1eb
Author: Satyanarayana K V P <satyanarayana.k.v.p@intel.com>

drm/xe/vf: Add bounds checking for queried VRAM size

This commit attempts to add checks for the VRAM size queried from the PF
to protect VF initialization from invalid configuration data.

> diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_vf.c b/drivers/gpu/drm/xe/xe_gt_sriov_vf.c
> index d805c064377c3..be932ebe6a8d0 100644
> --- a/drivers/gpu/drm/xe/xe_gt_sriov_vf.c
> +++ b/drivers/gpu/drm/xe/xe_gt_sriov_vf.c
> @@ -574,6 +574,12 @@ static int vf_get_lmem_info(struct xe_gt *gt)
>  		return -EREMCHG;
>  	}
>  
> +	if (!IS_ALIGNED(size, SZ_2M)) {
> +		xe_gt_sriov_err(gt, "Unaligned LMEM size %llu, expected %llu\n",
> +				size, ALIGN(size, SZ_2M));
> +		return -EINVAL;
> +	}
> +

[Severity: High]
This is a pre-existing issue, but the commit message states this patch adds
"bounds checking" to reject invalid configuration data, while this code
only implements an alignment check.

Does vf_get_lmem_info() also need an upper bounds check for the queried size?

If a misconfigured or compromised PF provides an artificially large VRAM
size, there doesn't appear to be a check against the VF's PCI LMEM BAR
size here. Could this unverified size propagate to vram->usable_size and
allow userspace to allocate VRAM beyond physical capacity, leading to
out-of-bounds memory accesses?

>  	string_get_size(size, 1, STRING_UNITS_2, size_str, sizeof(size_str));
>  	xe_gt_sriov_dbg_verbose(gt, "LMEM %lluM %s\n", size / SZ_1M, size_str);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260812124313.1377582-9-satyanarayana.k.v.p@intel.com?part=6