[Intel-xe] [PATCH 1/4] drm/xe: Ensure that we don't access the placements array out-of-bounds

[Ohad Sharabi]

On 22/11/2023 13:03, Thomas Hellström wrote:
> Ensure, using xe_assert that the various try_add_<placement> functions
> don't access the bo placements array out-of-bounds.
>
> Suggested-by: Ohad Sharabi <osharabi at habana.ai>
> Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/946
> Signed-off-by: Thomas Hellström <thomas.hellstrom at linux.intel.com>

Reviewed-by: Ohad Sharabi<osharabi at habana.ai>

> ---
>   drivers/gpu/drm/xe/xe_bo.c | 14 ++++++++++----
>   1 file changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index 4305f5cbc2ab..915910b87faa 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
> @@ -121,9 +121,11 @@ static struct xe_mem_region *res_to_mem_region(struct ttm_resource *res)
>       return to_xe_ttm_vram_mgr(mgr)->vram;
>   }
>
> -static void try_add_system(struct xe_bo *bo, struct ttm_place *places,
> -                        u32 bo_flags, u32 *c)
> +static void try_add_system(struct xe_device *xe, struct xe_bo *bo,
> +                        struct ttm_place *places, u32 bo_flags, u32 *c)
>   {
> +     xe_assert(xe, *c < ARRAY_SIZE(bo->placements));
> +
>       if (bo_flags & XE_BO_CREATE_SYSTEM_BIT) {
>               places[*c] = (struct ttm_place) {
>                       .mem_type = XE_PL_TT,
> @@ -172,6 +174,8 @@ static void add_vram(struct xe_device *xe, struct xe_bo *bo,
>   static void try_add_vram(struct xe_device *xe, struct xe_bo *bo,
>                        struct ttm_place *places, u32 bo_flags, u32 *c)
>   {
> +     xe_assert(xe, *c < ARRAY_SIZE(bo->placements));
> +
>       if (bo->props.preferred_gt == XE_GT1) {
>               if (bo_flags & XE_BO_CREATE_VRAM1_BIT)
>                       add_vram(xe, bo, places, bo_flags, XE_PL_VRAM1, c);
> @@ -188,6 +192,8 @@ static void try_add_vram(struct xe_device *xe, struct xe_bo *bo,
>   static void try_add_stolen(struct xe_device *xe, struct xe_bo *bo,
>                          struct ttm_place *places, u32 bo_flags, u32 *c)
>   {
> +     xe_assert(xe, *c < ARRAY_SIZE(bo->placements));
> +
>       if (bo_flags & XE_BO_CREATE_STOLEN_BIT) {
>               places[*c] = (struct ttm_place) {
>                       .mem_type = XE_PL_STOLEN,
> @@ -210,11 +216,11 @@ static int __xe_bo_placement_for_flags(struct xe_device *xe, struct xe_bo *bo,
>       /* The order of placements should indicate preferred location */
>
>       if (bo->props.preferred_mem_class == DRM_XE_MEM_REGION_CLASS_SYSMEM) {
> -             try_add_system(bo, places, bo_flags, &c);
> +             try_add_system(xe, bo, places, bo_flags, &c);
>               try_add_vram(xe, bo, places, bo_flags, &c);
>       } else {
>               try_add_vram(xe, bo, places, bo_flags, &c);
> -             try_add_system(bo, places, bo_flags, &c);
> +             try_add_system(xe, bo, places, bo_flags, &c);
>       }
>       try_add_stolen(xe, bo, places, bo_flags, &c);
>