[PATCH] drm/amdkfd: Fix a __user pointer dereference in create_signal_event

[Lazar, Lijo]

On 10/13/2021 1:03 PM, Lang Yu wrote:
> We should not dereference __user pointers directly.
> https://yarchive.net/comp/linux/user_pointers.html
> 
> Fixes: 482f07775cf5
> ("drm/amdkfd: Simplify event ID and signal slot management")
> 
> Signed-off-by: Lang Yu <lang.yu at amd.com>
> ---
>   drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
> index 3eea4edee355..74d3bdcfe341 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
> @@ -201,7 +201,7 @@ static int create_signal_event(struct file *devkfd,
>   
>   	p->signal_event_count++;
>   
> -	ev->user_signal_address = &p->signal_page->user_address[ev->event_id];

This is interesting. I thought this wouldn't dereference.

See here -

https://en.cppreference.com/w/c/language/operator_member_access

"If the operand is an array index expression, no action is taken other 
than the array-to-pointer conversion and the addition, so &a[N] is valid 
for an array of size N (obtaining a pointer one past the end is okay, 
dereferencing it is not, but dereference cancels out in this expression)"

Thanks,
Lijo


> +	ev->user_signal_address = p->signal_page->user_address + ev->event_id;
>   	pr_debug("Signal event number %zu created with id %d, address %p\n",
>   			p->signal_event_count, ev->event_id,
>   			ev->user_signal_address);
>