Re: [PATCH] drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise

[Matthew Auld <matthew.auld@intel.com>]

On 03/02/2026 17:20, Jia Yao wrote:
> When user provides a bogus pat_index value through the madvise IOCTL, the
> xe_pat_index_get_coh_mode() function performs an array access without
> validating bounds. This allows a malicious user to trigger an out-of-bounds
> kernel read from the xe->pat.table array.
> 
> The vulnerability exists because the validation in madvise_args_are_sane()
> directly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without
> first checking if pat_index is within [0, xe->pat.n_entries).
> 
> Although xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug
> builds, it still performs the unsafe array access in production kernels.
> 
> Fix this by adding an explicit bounds check before calling the function,
> similar to other IOCTL parameter validations. This prevents malicious
> userspace from reading arbitrary kernel memory.
> 
> Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe")
> Cc: Matthew Auld <matthew.auld@intel.com>
> Signed-off-by: Jia Yao <jia.yao@intel.com>

Cc: <stable@vger.kernel.org> # v6.18+

You can use "dim fixes <commit-id>" to get the right tags.

> ---
>   drivers/gpu/drm/xe/xe_vm_madvise.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_vm_madvise.c b/drivers/gpu/drm/xe/xe_vm_madvise.c
> index add9a6ca2390..c109f9adf6fb 100644
> --- a/drivers/gpu/drm/xe/xe_vm_madvise.c
> +++ b/drivers/gpu/drm/xe/xe_vm_madvise.c
> @@ -291,6 +291,9 @@ static bool madvise_args_are_sane(struct xe_device *xe, const struct drm_xe_madv
>   		break;
>   	case DRM_XE_MEM_RANGE_ATTR_PAT:
>   	{
> +		if (XE_IOCTL_DBG(xe, args->pat_index.val >= xe->pat.n_entries))
> +			return false;
> +

I think we are meant to use array_index_nospec() also? We have the same 
check for vm_bind, so you can use that as an example.

>   		u16 coh_mode = xe_pat_index_get_coh_mode(xe, args->pat_index.val);
>   
>   		if (XE_IOCTL_DBG(xe, !coh_mode))