Re: [PATCH v4 4/4] drm/amdgpu: add upper bound check on user inputs in wait ioctl

[Khatri, Sunil]

On 24-02-2026 02:15 pm, Christian König wrote:

On 2/24/26 09:24, Sunil Khatri wrote:
Huge input values in amdgpu_userq_wait_ioctl can lead to a OOM and
could be exploited.

So check these input value against AMDGPU_USERQ_MAX_HANDLES
which is big enough value for genuine use cases and could
potentially avoid OOM.

Signed-off-by: Sunil Khatri<sunil.kha...@amd.com>
---
  drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c | 7 +++++++
  1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
index 4f9386677c47..c2435ddfbd49 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
@@ -636,6 +636,13 @@ int amdgpu_userq_wait_ioctl(struct drm_device *dev, void 
*data,
        if (!amdgpu_userq_enabled(dev))
                return -ENOTSUPP;
  
+	if (wait_info->num_syncobj_handles > AMDGPU_USERQ_MAX_HANDLES ||
+           wait_info->num_syncobj_timeline_handles > AMDGPU_USERQ_MAX_HANDLES 
||
+           wait_info->syncobj_timeline_points > AMDGPU_USERQ_MAX_HANDLES ||
That here is wrong, syncobj_timeline_points is a 64bit VA pointer.
Right, but do we want to set the value to be much bigger value for this ?

The number of timeline points is always the same as the number of timeline 
syncobj handles.

So should i check only for num_syncobj_timeline_handles, or its ok to 
check for both ?

Regards Sunil khatri


Regards,
Christian.

+           wait_info->num_bo_write_handles > AMDGPU_USERQ_MAX_HANDLES ||
+           wait_info->num_bo_read_handles > AMDGPU_USERQ_MAX_HANDLES)
+               return -EINVAL;
+
        num_syncobj = wait_info->num_syncobj_handles;
        syncobj_handles = 
memdup_array_user(u64_to_user_ptr(wait_info->syncobj_handles),
                                            num_syncobj, sizeof(u32));