From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76B5A496919; Sat, 28 Feb 2026 17:46:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300790; cv=none; b=E4KhSP/LE0vjJMi608a0G7GqBUzp/XSD6KP5D7lEuIdojx9b5cE3KNV7diy32r+ibsv2vqZ+RpL9aGBSN0x5/HqMkKwZ0Ksjbw1/edIoviuPze6kIZ4Tlv+YLBNPiYXI2LZ5RFyIBpKZGZcy/4UIoOcoAmccobxkwRViAMie+AY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300790; c=relaxed/simple; bh=Ad8rp7JJ8JuTBBW0xVn+Hrn34sFXYY/i1r51x1S/7+c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ufUQ37ocMabHgZo7DI4Cv75EVIiCICsr+DTugRRFo9e94s0+ky6/L0XwzOSlC3Xiw9lC9s3Rv5fNmrp68Dp8IqN6xTUDrPSnBu06v2ls7dTlxF+pWJwHChVK7w+ZUWJeqJjHNswfc1V4hq5TrSzz2pnfjQ1vqn+QDzFtCBIpOGc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=iWIj0fJk; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="iWIj0fJk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 54EFFC116D0; Sat, 28 Feb 2026 17:46:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772300790; bh=Ad8rp7JJ8JuTBBW0xVn+Hrn34sFXYY/i1r51x1S/7+c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iWIj0fJk3SFF3scMnklTFKO1pNOnvCAb59p9Jqs05KPXyP20fxAn/+ech82xgyvW+ 8XZQc3VoO5P9j8TT3HiEkDpoPEB09d4YdO8kuLLg8rR8/QDNE4uHVg/RCFjETQZ8gG fNbdJvCCus0aPsRHLWEMwwAwh72iiUa/paIf1DQgan6PxBZinHNNQtC8EMJEjSkHxt Y3f85sbX2ek8e/xXVDN+ckDhb4phQpAf9se0Cm2ykaAgkbP4dWD2zxMDGampC8sRrZ fPo0g9YH2fGc+JVSm959rJk1ZQ+/95oMBi+hmOle2ZNIv5mqq+4FFmDr2T1U/LiCB+ hwZtN7lWsZfXg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jia Yao , Matthew Auld , Matthew Brost , Shuicheng Lin , Himal Prasad Ghimiray , =?UTF-8?q?Thomas=20Hellstr=C3=B6m?= , Rodrigo Vivi , Sasha Levin Subject: [PATCH 6.19 822/844] drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise Date: Sat, 28 Feb 2026 12:32:15 -0500 Message-ID: <20260228173244.1509663-823-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260228173244.1509663-1-sashal@kernel.org> References: <20260228173244.1509663-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit From: Jia Yao [ Upstream commit fbbe32618e97eff81577a01eb7d9adcd64a216d7 ] When user provides a bogus pat_index value through the madvise IOCTL, the xe_pat_index_get_coh_mode() function performs an array access without validating bounds. This allows a malicious user to trigger an out-of-bounds kernel read from the xe->pat.table array. The vulnerability exists because the validation in madvise_args_are_sane() directly calls xe_pat_index_get_coh_mode(xe, args->pat_index.val) without first checking if pat_index is within [0, xe->pat.n_entries). Although xe_pat_index_get_coh_mode() has a WARN_ON to catch this in debug builds, it still performs the unsafe array access in production kernels. v2(Matthew Auld) - Using array_index_nospec() to mitigate spectre attacks when the value is used v3(Matthew Auld) - Put the declarations at the start of the block Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe") Reviewed-by: Matthew Auld Cc: # v6.18+ Cc: Matthew Brost Cc: Shuicheng Lin Cc: Himal Prasad Ghimiray Cc: "Thomas Hellström" Cc: Rodrigo Vivi Cc: Matthew Auld Signed-off-by: Jia Yao Signed-off-by: Matthew Auld Link: https://patch.msgid.link/20260205161529.1819276-1-jia.yao@intel.com (cherry picked from commit 944a3329b05510d55c69c2ef455136e2fc02de29) Signed-off-by: Rodrigo Vivi Signed-off-by: Sasha Levin --- drivers/gpu/drm/xe/xe_vm_madvise.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xe/xe_vm_madvise.c b/drivers/gpu/drm/xe/xe_vm_madvise.c index cad3cf627c3f2..fe7e1b45f5c0c 100644 --- a/drivers/gpu/drm/xe/xe_vm_madvise.c +++ b/drivers/gpu/drm/xe/xe_vm_madvise.c @@ -268,8 +268,13 @@ static bool madvise_args_are_sane(struct xe_device *xe, const struct drm_xe_madv break; case DRM_XE_MEM_RANGE_ATTR_PAT: { - u16 coh_mode = xe_pat_index_get_coh_mode(xe, args->pat_index.val); + u16 pat_index, coh_mode; + if (XE_IOCTL_DBG(xe, args->pat_index.val >= xe->pat.n_entries)) + return false; + + pat_index = array_index_nospec(args->pat_index.val, xe->pat.n_entries); + coh_mode = xe_pat_index_get_coh_mode(xe, pat_index); if (XE_IOCTL_DBG(xe, !coh_mode)) return false; -- 2.51.0