From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00CE7352036 for ; Sat, 13 Jun 2026 21:37:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781386675; cv=none; b=gMAVKlLoIb4Oi2AuzaEGsMBj7fdK7/0nB0UbeqvihAZe5bUdY6CTfax9RkSCIiUcrgwXV74MqFPfg/V+aOGJc6KTV0AX0Gxu1qK7649OY59N/jXJncBMdUGX3ux3C0C27ZKXlPt6+rdF8yNuzX5LP1tc509aOiNpveJaMe37PZA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781386675; c=relaxed/simple; bh=f6y3My2ZQvfxZhOOolihbVpVvgen2xGSIah4eub4Vrw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=Fw2L+y/QnB/0X7M+0XMp0qTayQ9k8oO4xxSZcOfpD9KzAcomhYoTV2It3ijYw+soOFzvr57akjUTAhXjOD5oBvGkIQ5RvcltTP0+QvAt7dt918qZGVngYs6p4XORQvWfAIxg7cLDAuRR6LTko6qbiclDADtzLHKEVzfj4OFdFKE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=RwTIRVm2; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="RwTIRVm2" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-36d98c9b596so1334618a91.3 for ; Sat, 13 Jun 2026 14:37:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781386673; x=1781991473; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=MfPgGYbUm8nj37ORB1VbQeWiG3oQfXInp8XqV1czevs=; b=RwTIRVm2A/+kmzg+NU1lGTogMqTGlx8U7zKR9PiC0hzgGXDPfmjSLblrW9Ey+tnnpi CK7DdGbRwtcDDgKuh/J794Aimpx+P8qFsr/ZC36IUHzLWILTpacSbXanwRq3TWqRod6L SjG5UzRLsfwTHH/7tndPygFeAqmngAE+SulY++uw8j5/9I4x9DyZR7QJMX/e0lZwshms NELOg5ujWizdRzCiClWdNQdPKAc8fZkssdC3Zp/CItaX2tEbw42+ILACAnGGlMcXvi+A Peo5HoUkiyRnsrv8pheNXAZTVJj5bW4N3FDS2JmsYu86nf1h4icc2Xc9U87vEl5QnSsJ xv0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781386673; x=1781991473; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=MfPgGYbUm8nj37ORB1VbQeWiG3oQfXInp8XqV1czevs=; b=XZ0e13jZp7ZDc3tjbozvcaMTZWhO2fi2QPxybM09rFOj4lW48Y5hmihU+T6urmO3Hr +pJW+MAd4HnXobM36fYGQGvVOIxFkWgwq8i+z6XHEiKoWdBdUqjrxI020n8YgIoLYlJe WA7u1E7id4mCbfCT9drQXw0SDt4wSkvQBMf6ezFM9Qklq1P1QoqvXdM66p0CyLr447jx Tq2pnP4pFRQ8Y/P/SlrPplBLmkmSM2CF5uiHZXXsHJ/9/FZrMofQmLgn5mIQqGf7ZPHL 4/8v6zya0qSAohnY5UmQ/RIVjm5pPBVkSPCjwMVA0W3qzXgid0m8QbYa9XamTXJKxd2e bF4Q== X-Forwarded-Encrypted: i=1; AFNElJ9ZAX6atnzaroTpk3mwPfwA6NsmlpNwiCR/vXPn+qya19Um2gwrrmR3HJKcwBGu8+9N0vnjyf2r4auIqro=@vger.kernel.org X-Gm-Message-State: AOJu0Yy2wzC4fdCSDASLeqyMJe4Wlr79ZI38NC+O+/HsRykGiyp5e06r mOPUDWLFnawzmzvpVBY9bYndBScD8St66faYPEUH71P+5UJlKG/8IN0F X-Gm-Gg: Acq92OHDp+6aPnAh0KcAhkNMMmuVDuOeGhw/nHsz3Hu93mrWMPeck41am9FOYJzMykN YwYRd5/sXkCjxVkn3GIVhxqDeqdB2lIbj8RvEEelASOyfdrz9Hy5wJieYb+DTNaGqJouTZwRzBh qA9ACMUUU6Qu3BqKjgGGv1G6rRNNogcEEhLEI+22mc4WCzIljKFCklZ3oW6qeAX9Y7qzK/7EzKL BBtpHzFDPl3MYZALaKJo+9N23WrB5mzQlLwp1b/LfZCT+7m3zQms+Xa/mVYIb7Loaa0NxJXVzB9 hHnL0HV1JQ06gKk4gmgDF1RBRFwt9l6ESTZ7O5B1Jwop35WljH0usNySfDaVscZ0NzsgO0Pr+1p i1YQEnq/shL3/R/gCCfaGtoVRiRAOT6n1feaqUi3w40RkjSWchvHnlSQY+a+eFr6lLZg2IDGXEi nCAEB5k9ov7zmxDBZjOlo290dmj+g04Jjs/IPT6OLG2TxGFuLxoe25KKwPn8kFYCLU7lf9HTB8l 3QB7xMTeR8kii3Fnejx X-Received: by 2002:a17:90b:4a11:b0:36a:4074:9aa6 with SMTP id 98e67ed59e1d1-37a01b3f8b6mr8250263a91.6.1781386673358; Sat, 13 Jun 2026 14:37:53 -0700 (PDT) Received: from Shuvs-MacBook-Air.local ([103.129.134.130]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-37a20dbc386sm5822002a91.11.2026.06.13.14.37.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 13 Jun 2026 14:37:52 -0700 (PDT) From: Shuvam Pandey To: Min Ma , Lizhi Hou , Oded Gabbay Cc: Max Zhen , Mario Limonciello , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH] accel/amdxdna: Validate sync BO range before flushing Date: Sun, 14 Jun 2026 03:22:47 +0545 Message-ID: <178138666764.88126.6546036881766614184@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit amdxdna_drm_sync_bo_ioctl() takes offset and size from userspace and uses them to build the address and length passed to drm_clflush_virt_range() for BOs that have a kernel mapping. The values are not checked against the BO size, so an out-of-range request can pass an address outside the BO mapping to cache maintenance. Reject ranges outside the GEM object. Treat zero-length ranges as a no-op before cache maintenance, because drm_clflush_virt_range() still flushes end - 1 on x86. Leave the existing SYNC_DIRECT_FROM_DEVICE debug-buffer sync behavior unchanged. Fixes: d76856beb4a4 ("accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval") Signed-off-by: Shuvam Pandey --- drivers/accel/amdxdna/amdxdna_gem.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c index 6e367ddb9e1b..c56c8fd86276 100644 --- a/drivers/accel/amdxdna/amdxdna_gem.c +++ b/drivers/accel/amdxdna/amdxdna_gem.c @@ -1040,20 +1040,33 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev, } abo = to_xdna_obj(gobj); + if (args->offset > gobj->size || + args->size > gobj->size - args->offset) { + ret = -EINVAL; + goto put_obj; + } + ret = amdxdna_gem_pin(abo); if (ret) { XDNA_ERR(xdna, "Pin BO %d failed, ret %d", args->handle, ret); goto put_obj; } - if (is_import_bo(abo)) - drm_clflush_sg(abo->base.sgt); - else if (amdxdna_gem_vmap(abo)) - drm_clflush_virt_range(amdxdna_gem_vmap(abo) + args->offset, args->size); - else if (abo->base.pages) - drm_clflush_pages(abo->base.pages, gobj->size >> PAGE_SHIFT); - else - drm_WARN(&xdna->ddev, 1, "Can not get flush memory"); + if (args->size) { + if (is_import_bo(abo)) { + drm_clflush_sg(abo->base.sgt); + } else { + void *kva = amdxdna_gem_vmap(abo); + + if (kva) + drm_clflush_virt_range(kva + args->offset, + args->size); + else if (abo->base.pages) + drm_clflush_pages(abo->base.pages, gobj->size >> PAGE_SHIFT); + else + drm_WARN(&xdna->ddev, 1, "Can not get flush memory"); + } + } amdxdna_gem_unpin(abo);