linux-kernel - [PATCH] drm/amdgpu: restrict the hw sched jobs upper bound

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250421150905.732842-1-sdl@nppct.ru>
Date: Mon, 21 Apr 2025 15:09:03 +0000
From: Alexey Nepomnyashih <sdl@...ct.ru>
To: Alex Deucher <alexander.deucher@....com>
Cc: Alexey Nepomnyashih <sdl@...ct.ru>,
	Christian König <christian.koenig@....com>,
	"Pan, Xinhui" <Xinhui.Pan@....com>,
	David Airlie <airlied@...il.com>,
	Daniel Vetter <daniel@...ll.ch>,
	Sasha Levin <sashal@...nel.org>,
	Lijo Lazar <lijo.lazar@....com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Srinivasan Shanmugam <srinivasan.shanmugam@....com>,
	Friedrich Vock <friedrich.vock@....de>,
	Victor Zhao <Victor.Zhao@....com>,
	amd-gfx@...ts.freedesktop.org,
	dri-devel@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org,
	lvc-project@...uxtesting.org,
	stable@...r.kernel.org
Subject: [PATCH] drm/amdgpu: restrict the hw sched jobs upper bound

The amdgpu_sched_hw_submission parameter controls the number of hardware
jobs that can be scheduled concurrently per ring. This value is later
multiplied by ring->max_dw to compute buffer offsets or command patch
regions.

If amdgpu_sched_hw_submission is set too high (by user input via module
parameter), the multiplication can overflow, resulting in corrupted memory
offsets or ring buffer overflows.

Clamp amdgpu_sched_hw_submission to a practical upper bound (e.g. 2^16)
to prevent arithmetic overflow when computing ring buffer offsets during
initialization, especially in jpeg_v1_0_start().

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Cc: stable@...r.kernel.org # v5.9+
Fixes: 5d5bd5e32e6e ("drm/amdgpu: restrict the hw sched jobs number to power of two")
Signed-off-by: Alexey Nepomnyashih <sdl@...ct.ru>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 018dfccd771b..69217a021b0e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2056,6 +2056,10 @@ static int amdgpu_device_check_arguments(struct amdgpu_device *adev)
 		dev_warn(adev->dev, "sched hw submission jobs (%d) must be at least 2\n",
 			 amdgpu_sched_hw_submission);
 		amdgpu_sched_hw_submission = 2;
+	} else if (amdgpu_sched_hw_submission > 65536) {
+		dev_warn(adev->dev, "sched hw submission jobs (%d) is too large\n",
+			 amdgpu_sched_hw_submission);
+		amdgpu_sched_hw_submission = 65536;
 	} else if (!is_power_of_2(amdgpu_sched_hw_submission)) {
 		dev_warn(adev->dev, "sched hw submission jobs (%d) must be a power of 2\n",
 			 amdgpu_sched_hw_submission);
-- 
2.43.0