linux-kernel - Re: [PATCH] drm/amdgpu: prevent BO_HANDLES error from being overwritten

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8588f179-9a69-44c3-aedc-0670ef948068@amd.com>
Date: Wed, 9 Oct 2024 12:34:24 +0200
From: Christian König <christian.koenig@....com>
To: Pierre-Eric Pelloux-Prayer <pierre-eric@...sy.net>,
 Mohammed Anees <pvmohammedanees2003@...il.com>,
 amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
 linux-kernel@...r.kernel.org
Cc: Alex Deucher <alexander.deucher@....com>, Xinhui Pan
 <Xinhui.Pan@....com>, David Airlie <airlied@...il.com>,
 Simona Vetter <simona@...ll.ch>,
 Srinivasan Shanmugam <srinivasan.shanmugam@....com>,
 David Wu <David.Wu3@....com>, Felix Kuehling <felix.kuehling@....com>
Subject: Re: [PATCH] drm/amdgpu: prevent BO_HANDLES error from being
 overwritten

Am 09.10.24 um 10:22 schrieb Pierre-Eric Pelloux-Prayer:
> Hi,
>
> Le 05/10/2024 à 01:59, Mohammed Anees a écrit :
>> Before this patch, if multiple BO_HANDLES chunks were submitted,
>> the error -EINVAL would be correctly set but could be overwritten
>> by the return value from amdgpu_cs_p1_bo_handles(). This patch
>> ensures that once an error condition is detected, the function
>> returns immediately, avoiding the overwriting of the error code.
>>
>> Signed-off-by: Mohammed Anees <pvmohammedanees2003@...il.com>
>> ---
>>   drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c 
>> b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
>> index 1e475eb01417..543db0df9a31 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
>> @@ -266,8 +266,9 @@ static int amdgpu_cs_pass1(struct 
>> amdgpu_cs_parser *p,
>>               /* Only a single BO list is allowed to simplify 
>> handling. */
>>               if (p->bo_list)
>>                   ret = -EINVAL;
>> +            else
>> +                ret = amdgpu_cs_p1_bo_handles(p, p->chunks[i].kdata);
>>   -            ret = amdgpu_cs_p1_bo_handles(p, p->chunks[i].kdata);
>
> My bad, I've merged the wrong version of the patch.
>
> That being said, I think it'd be nicer to follow the same pattern as 
> the other checks and do:
>
>    if (p->bo_list)
>       goto free_partial_kdata;
>
> Since "ret" is initialized to -EINVAL already.
>
> Also can you add a reference to the broken commit in the commit message?
> Something like:
>
> Fixes: fec5f8e8c6bcf83 ("drm/amdgpu: disallow multiple BO_HANDLES 
> chunks in one submit")

Yeah agree with Pierre-Eric and also please add the same CC stable tag 
the original patch had so that it gets backported ASAP.

Thanks,
Christian.

>
> Thanks,
> Pierre-Eric
>
>>               if (ret)
>>                   goto free_partial_kdata;
>>               break;