Intel-XE Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise
@ 2026-02-03 17:20 Jia Yao
  2026-02-03 17:27 ` ✓ CI.KUnit: success for " Patchwork
                   ` (15 more replies)
  0 siblings, 16 replies; 21+ messages in thread
From: Jia Yao @ 2026-02-03 17:20 UTC (permalink / raw)
  To: intel-xe; +Cc: Jia Yao, Matthew Auld

When user provides a bogus pat_index value through the madvise IOCTL, the
xe_pat_index_get_coh_mode() function performs an array access without
validating bounds. This allows a malicious user to trigger an out-of-bounds
kernel read from the xe->pat.table array.

The vulnerability exists because the validation in madvise_args_are_sane()
directly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without
first checking if pat_index is within [0, xe->pat.n_entries).

Although xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug
builds, it still performs the unsafe array access in production kernels.

Fix this by adding an explicit bounds check before calling the function,
similar to other IOCTL parameter validations. This prevents malicious
userspace from reading arbitrary kernel memory.

Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe")
Cc: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Jia Yao <jia.yao@intel.com>
---
 drivers/gpu/drm/xe/xe_vm_madvise.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/xe/xe_vm_madvise.c b/drivers/gpu/drm/xe/xe_vm_madvise.c
index add9a6ca2390..c109f9adf6fb 100644
--- a/drivers/gpu/drm/xe/xe_vm_madvise.c
+++ b/drivers/gpu/drm/xe/xe_vm_madvise.c
@@ -291,6 +291,9 @@ static bool madvise_args_are_sane(struct xe_device *xe, const struct drm_xe_madv
 		break;
 	case DRM_XE_MEM_RANGE_ATTR_PAT:
 	{
+		if (XE_IOCTL_DBG(xe, args->pat_index.val >= xe->pat.n_entries))
+			return false;
+
 		u16 coh_mode = xe_pat_index_get_coh_mode(xe, args->pat_index.val);
 
 		if (XE_IOCTL_DBG(xe, !coh_mode))
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 21+ messages in thread
end of thread, other threads:[~2026-02-06 15:19 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-03 17:20 [PATCH] drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise Jia Yao
2026-02-03 17:27 ` ✓ CI.KUnit: success for " Patchwork
2026-02-03 17:29 ` [PATCH] " Matthew Auld
2026-02-03 18:02 ` ✗ Xe.CI.BAT: failure for " Patchwork
2026-02-03 21:06 ` [PATCH v2] " Jia Yao
2026-02-04 15:44   ` Matthew Auld
2026-02-04 18:15     ` Yao, Jia
2026-02-05 10:21       ` Matthew Auld
2026-02-03 21:14 ` ✓ CI.KUnit: success for drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise (rev2) Patchwork
2026-02-03 21:47 ` ✗ Xe.CI.BAT: failure " Patchwork
2026-02-03 22:33 ` ✓ CI.KUnit: success for drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise (rev3) Patchwork
2026-02-03 23:06 ` ✗ Xe.CI.BAT: failure " Patchwork
2026-02-04 13:05 ` ✗ Xe.CI.FULL: " Patchwork
2026-02-05  0:10 ` ✓ CI.KUnit: success for drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise (rev4) Patchwork
2026-02-05  0:43 ` ✓ Xe.CI.BAT: " Patchwork
2026-02-05 15:38 ` ✗ Xe.CI.FULL: failure " Patchwork
2026-02-05 16:15 ` [PATCH v3] drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise Jia Yao
2026-02-05 16:30   ` Matthew Auld
2026-02-05 16:22 ` ✓ CI.KUnit: success for drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise (rev5) Patchwork
2026-02-05 17:03 ` ✓ Xe.CI.BAT: " Patchwork
2026-02-06 15:19 ` ✗ Xe.CI.FULL: failure " Patchwork

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox