From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 54D6847253B for ; Tue, 4 Aug 2026 16:00:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785859255; cv=none; b=YvJUwYcBr6/KSNYMMGBQ/7y06GWtMUCE3OLdZy9ns81ZpbRQ98lz1OIblztDIA4FFM7ZyRo4RQTGy3bt5r9YanHMxIW4WPSr4tsqb5+FzOvNjQQ2W9JdNbhh76tyM5OgpQO/57REshsKvfeE0nZ+rkCKQTOE98Gy41PVLKJa7hk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785859255; c=relaxed/simple; bh=L4zI4rFzbBdq96SX5DdXQZ7hn9ePYp9NpqWY50dUL0U=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=s6p7id9ayd0OI8PdzlazW4QTuUT5ofNvtrwTQp4AaF39zPMsRt2TicqXGpZQX4mMqyLTeomCYMvnLn2b+nqLGWfBJ/23DbEy+9PdHmPAE/KPxepc2v2tq53O7SSNpN+7KgTqVtrVZdlP27xetat4NUZz5l49n7EkXBu19gb4K6I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MyMlvdlq; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MyMlvdlq" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-4980dc26022so24259635e9.1 for ; Tue, 04 Aug 2026 09:00:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785859252; x=1786464052; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=39LYywLmPcXSkKCIulhHDm7OS4Hd0MM7+1BesXcpx0I=; b=MyMlvdlq7EaKRhttWcIPfr4o5JcOSpOkX4IOfVqaL+wg/k3qnDh7rIDdckCs0UaNyS LRs/GbrqvotxSoYpYcY9dpnQT7WkG1PF4x8wOZEeGweRfdHMgXQ/vSeIggGAKFhVOR6q Tdxnx9aRKB8c6t4pcveQZIyD2fgZWQ2bOLHkPSlXAkNes2Id8+HJN3oOvnRiiXcXwyxX bRkrm8XDs2+c7NcikGoZXlYw8wm1pwHGcYS6mVu8NNJjsMYb9oXqLa9Hwp7F1yxnqeVr Ni/KdXWUTGRUzU3VmlqCtYeij/u5rgo+MvLqJ+iDqua5O8IKB+W1798+r/wUW+HzSYvW e/nA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785859252; x=1786464052; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=39LYywLmPcXSkKCIulhHDm7OS4Hd0MM7+1BesXcpx0I=; b=O121SDfnz+5MJRF9MUz8wOnkrqFaBC+K6ZqbIA+12aZsyV7S0PWBoi2W97r3exAd0V Ui/oq/xUQ3YaL0Pqc1PchGPHjxNHzWL6HPobsdrL4UCCjThlxUuW9uM5TvjY6GtA+WqJ 9twjS3Sf10Qnw8wJImRczQl+1crmBS2NyohlddIlxiZQz6xx7gVhwBrpQQRvdw26xVSU ReV1odWhrBWk9Dhzf3feN4n0c6C+gTazkl3AJG2y3ePYSEbOdlGAVEt+XLJXjHswEDrU 6Okm12whX4kbSwccBOAOu7EHvGBPli3u6r0c5m7M91g1uqbnRshXFWIPSIfvXAqmh+oG 6uuA== X-Forwarded-Encrypted: i=1; AHgh+Rq6JX+dJri//FWgc4cFNbraHAb8wq7OckBErhv5xU5TM7fmvf4wXuhepHFZ+zh/BIyzNsOa57U7D23Pokc=@vger.kernel.org X-Gm-Message-State: AOJu0Ywm8F9RsL/Lg6HkYI9c+takqW+GhgDEDKGSNFsGkEnZrDWtk8lO qiPlKpu4RgsmrX/P7YvsqCB74nBtjulh1jvELwTehabeOdJ3PJsB/dkU X-Gm-Gg: AR+sD13os3z9XtKaQ6RRK9q8l26IbjHaeHPLu7jSOdUUAXMkETxzzCY58SfqHwTaMF7 nQjzlRdKhm8gVNO4m5Gfj8fVSEJcPwT0TAFIjnI5M/LwkAd8bM9OUvmYlo2svAMLBnhH+iFynRM KJQhZ0QKO/6SZYyLF9nRzwZ0+VZxKH/j3Mo5mActEU3mOuCoFrmWgs+9eA7t9KCKKee1M+uNZxz wZywASdIo0LqSLp1sNZ5rgfsdMjG/PACsq4rbSpCzTxHiwUQ48GN2YiJ59owZiGZFBFj57tNk38 eskeo6NFCN6TRTRUQICrmtCJh+nnTrrNTpL2ha21G7NXVKh+WlJuFviKzDWN7YRvd0PcQkdJInz LnYmCcizlNMsPjP3sXybl1fE00y7tb2Sp5K7Y4OkAKM4vcVaEB0lFaAQL7/LNCyHfkuNRe5VS+b FzgigeYkMPFZ6x+jWdo/hf0LsgHMWYlsUX73qVsPZOprVtjuOKKloyn3xVTQZVG/ic57MMQ+Mdv KkmDBwg+5HbmPqq7aU7VW0fhg== X-Received: by 2002:a05:600c:1992:b0:498:28b:1045 with SMTP id 5b1f17b1804b1-4980c645611mr301569525e9.3.1785859252122; Tue, 04 Aug 2026 09:00:52 -0700 (PDT) Received: from osama.. ([2a02:908:185:7e40:b6d0:3270:8423:f239]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49807ba6abesm260913495e9.2.2026.08.04.09.00.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 04 Aug 2026 09:00:51 -0700 (PDT) From: Osama Abdelkader To: Boris Brezillon , Steven Price , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: Osama Abdelkader , stable@vger.kernel.org, sashiko-bot@kernel.org Subject: [PATCH] drm/panthor: validate userspace queue count against initialized firmware slot count Date: Tue, 4 Aug 2026 18:00:47 +0200 Message-ID: <20260804160048.174148-1-osama.abdelkader@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In panthor_drv.c:panthor_ioctl_group_create(), the queue count is validated against the hardcoded maximum: if (!args->queues.count || args->queues.count > MAX_CS_PER_CSG) return -EINVAL; However, if the firmware reports fewer slots than MAX_CS_PER_CSG, panthor_fw_init_ifaces() will only initialize that smaller number of stream interfaces. If unprivileged userspace requests more queues than the firmware reported (but no more than MAX_CS_PER_CSG), cs_slot_prog_locked() fetches an uninitialized stream interface and may crash when dereferencing cs_iface->input->ringbuf_base. Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block") Cc: stable@vger.kernel.org Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260803141149.68182-1-osama.abdelkader@gmail.com?part=1 Signed-off-by: Osama Abdelkader --- drivers/gpu/drm/panthor/panthor_sched.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c index 5832dccfc093..64749750e6ee 100644 --- a/drivers/gpu/drm/panthor/panthor_sched.c +++ b/drivers/gpu/drm/panthor/panthor_sched.c @@ -3673,6 +3673,9 @@ int panthor_group_create(struct panthor_file *pfile, hweight64(group_args->tiler_core_mask) < group_args->max_tiler_cores) return -EINVAL; + if (group_args->queues.count > sched->cs_slot_count) + return -EINVAL; + group = kzalloc_obj(*group); if (!group) return -ENOMEM; -- 2.43.0