drm/xe: Limit num_syncs to prevent oversized allocations

The exec and vm_bind ioctl allow userspace to specify an arbitrary num_syncs value. Without bounds checking, a very large num_syncs can force an excessively large allocation, leading to kernel warnings from the page allocator as below. Introduce DRM_XE_MAX_SYNCS (set to 1024) and reject any request exceeding this limit. " ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1217 at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof+0x2f8/0x2180 mm/page_alloc.c:5124 ... Call Trace: <TASK> alloc_pages_mpol+0xe4/0x330 mm/mempolicy.c:2416 ___kmalloc_large_node+0xd8/0x110 mm/slub.c:4317 __kmalloc_large_node_noprof+0x18/0xe0 mm/slub.c:4348 __do_kmalloc_node mm/slub.c:4364 [inline] __kmalloc_noprof+0x3d4/0x4b0 mm/slub.c:4388 kmalloc_noprof include/linux/slab.h:909 [inline] kmalloc_array_noprof include/linux/slab.h:948 [inline] xe_exec_ioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xe_exec.c:158 drm_ioctl_kernel+0x1f1/0x3e0 drivers/gpu/drm/drm_ioctl.c:797 drm_ioctl+0x5e7/0xc50 drivers/gpu/drm/drm_ioctl.c:894 xe_drm_ioctl+0x10b/0x170 drivers/gpu/drm/xe/xe_device.c:224 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xbb/0x380 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... " v2: Add "Reported-by" and Cc stable kernels. v3: Change XE_MAX_SYNCS from 64 to 1024. (Matt & Ashutosh) v4: s/XE_MAX_SYNCS/DRM_XE_MAX_SYNCS/ (Matt) v5: Do the check at the top of the exec func. (Matt)

Shuicheng Lin committed 11 months ago

Commit 8e461301 parent eed5b813 files · +6 −1Browse files

Unified · Split

3 files

drivers/gpu/drm/xe/xe_exec.c +2 −1
drivers/gpu/drm/xe/xe_vm.c +3 −0
include/uapi/drm/xe_drm.h +1 −0

drivers/gpu/drm/xe/xe_exec.c+2−1

@@ -132,7 +132,8 @@ int xe_exec_ioctl(struct drm_device dev, void data, struct drm_file *file) · 131 unmodified lines
132	132
133	133	if (XE_IOCTL_DBG(xe, args->extensions) \|\|
134	134	XE_IOCTL_DBG(xe, args->pad[0] \|\| args->pad[1] \|\| args->pad[2]) \|\|
135		− XE_IOCTL_DBG(xe, args->reserved[0] \|\| args->reserved[1]))
	135	+ XE_IOCTL_DBG(xe, args->reserved[0] \|\| args->reserved[1]) \|\|
	136	+ XE_IOCTL_DBG(xe, args->num_syncs > DRM_XE_MAX_SYNCS))
136	137	return -EINVAL;
137	138
138	139	q = xe_exec_queue_lookup(xef, args->exec_queue_id);

drivers/gpu/drm/xe/xe_vm.c+3−0

@@ -3324,6 +3324,9 @@ static int vm_bind_ioctl_check_args(struct xe_device xe, struct xe_vm vm, · 3323 unmodified lines
3324	3324	if (XE_IOCTL_DBG(xe, args->extensions))
3325	3325	return -EINVAL;
3326	3326
	3327	+ if (XE_IOCTL_DBG(xe, args->num_syncs > DRM_XE_MAX_SYNCS))
	3328	+ return -EINVAL;
	3329	+
3327	3330	if (args->num_binds > 1) {
3328	3331	u64 __user *bind_user =
3329	3332	u64_to_user_ptr(args->vector_of_binds);

include/uapi/drm/xe_drm.h+1−0

@@ -1463,6 +1463,7 @@ struct drm_xe_exec { · 1462 unmodified lines
1463	1463	/** @exec_queue_id: Exec queue ID for the batch buffer */
1464	1464	__u32 exec_queue_id;
1465	1465
	1466	+#define DRM_XE_MAX_SYNCS 1024
1466	1467	/** @num_syncs: Amount of struct drm_xe_sync in array. */
1467	1468	__u32 num_syncs;
1468	1469

drm/xe: Limit num_syncs to prevent oversized allocations

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code