[PATCH v2 2/3] drm/xe: Validate user fence during creation

[Thomas Hellström]

On Fri, 2024-03-01 at 07:58 +0000, Matthew Brost wrote:
> On Fri, Mar 01, 2024 at 07:55:40AM +0100, Thomas Hellström wrote:
> > On Thu, 2024-02-29 at 19:55 -0800, Matthew Brost wrote:
> > > Fail invalidate addresses during user fence creation.
> > > 
> > > Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for
> > > Intel
> > > GPUs")
> > > Signed-off-by: Matthew Brost <matthew.brost at intel.com>
> > > Reviewed-by: Thomas Hellström <thomas.hellstrom at linux.intel.com>
> > > ---
> > >  drivers/gpu/drm/xe/xe_sync.c | 12 ++++++++----
> > >  1 file changed, 8 insertions(+), 4 deletions(-)
> > > 
> > > diff --git a/drivers/gpu/drm/xe/xe_sync.c
> > > b/drivers/gpu/drm/xe/xe_sync.c
> > > index c836a5f3a1ea..c20e1f9ad267 100644
> > > --- a/drivers/gpu/drm/xe/xe_sync.c
> > > +++ b/drivers/gpu/drm/xe/xe_sync.c
> > > @@ -53,14 +53,18 @@ static struct xe_user_fence
> > > *user_fence_create(struct xe_device *xe, u64 addr,
> > >  					       u64 value)
> > >  {
> > >  	struct xe_user_fence *ufence;
> > > +	u64 __user *ptr = u64_to_user_ptr(addr);
> > > +
> > > +	if (!access_ok(ptr, sizeof(ptr)))
> > > +		return ERR_PTR(-EFAULT);
> > 
> > I think we also need to enforce u64 alignment. Otherwise,
> > particularly
> > on 32-bit user-space the user fence memory could cross a page-
> > border? 
> > 
> 
> We already do this in xe_sync_entry_parse:
> 
> 221                 if (XE_IOCTL_DBG(xe, sync_in.addr & 0x7))
> 222                         return -EINVAL;
> 
> Matt

Ah, Great.


> 
> > >  
> > >  	ufence = kmalloc(sizeof(*ufence), GFP_KERNEL);
> > >  	if (!ufence)
> > > -		return NULL;
> > > +		return ERR_PTR(-ENOMEM);
> > >  
> > >  	ufence->xe = xe;
> > >  	kref_init(&ufence->refcount);
> > > -	ufence->addr = u64_to_user_ptr(addr);
> > > +	ufence->addr = ptr;
> > >  	ufence->value = value;
> > >  	ufence->mm = current->mm;
> > >  	mmgrab(ufence->mm);
> > > @@ -183,8 +187,8 @@ int xe_sync_entry_parse(struct xe_device *xe,
> > > struct xe_file *xef,
> > >  		} else {
> > >  			sync->ufence = user_fence_create(xe,
> > > sync_in.addr,
> > >  							
> > > sync_in.timeline_value);
> > > -			if (XE_IOCTL_DBG(xe, !sync->ufence))
> > > -				return -ENOMEM;
> > > +			if (XE_IOCTL_DBG(xe, IS_ERR(sync-
> > > >ufence)))
> > > +				return PTR_ERR(sync->ufence);
> > >  		}
> > >  
> > >  		break;
> >