Re: [PATCH v3 2/2] drm/xe/oa: Limit num_syncs to prevent oversized allocations

["Dixit, Ashutosh" <ashutosh.dixit@intel.com>]

On Fri, 05 Dec 2025 15:47:18 -0800, Shuicheng Lin wrote:
>
> The OA open parameters did not validate num_syncs, allowing
> userspace to pass arbitrarily large values, potentially
> leading to excessive allocations.
>
> Add check to ensure that num_syncs does not exceed DRM_XE_MAX_SYNCS,
> returning -EINVAL when the limit is violated.
>
> v2: use XE_IOCTL_DBG() and drop duplicated check. (Ashutosh)

Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>

>
> Fixes: c8507a25cebd ("drm/xe/oa/uapi: Define and parse OA sync properties")
> Cc: Matthew Brost <matthew.brost@intel.com>
> Cc: Ashutosh Dixit <ashutosh.dixit@intel.com>
> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_oa.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c
> index cc48663c2b48..92aa25fc0422 100644
> --- a/drivers/gpu/drm/xe/xe_oa.c
> +++ b/drivers/gpu/drm/xe/xe_oa.c
> @@ -1254,6 +1254,9 @@ static int xe_oa_set_no_preempt(struct xe_oa *oa, u64 value,
>  static int xe_oa_set_prop_num_syncs(struct xe_oa *oa, u64 value,
>				    struct xe_oa_open_param *param)
>  {
> +	if (XE_IOCTL_DBG(oa->xe, value > DRM_XE_MAX_SYNCS))
> +		return -EINVAL;
> +
>	param->num_syncs = value;
>	return 0;
>  }
> --
> 2.50.1
>