From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f177.google.com (mail-qt1-f177.google.com [209.85.160.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AB1493603D9 for ; Sun, 14 Jun 2026 13:11:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781442666; cv=none; b=huY+nJ5uLstEp1mEmVK9eo1xcTHuWNPIYcZncZEqNts3nzh7a3gqLREsY1khoBWKK4Jp+TD1pXeY2kG8TkPCHA6kJ9dws3RJN6+A3kjB2XA55O753Y9rsLJUGRRtDkSY+fKJUJ/dDUgTmF3oQNln9agdi1+NUAkmL7XMfpUN480= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781442666; c=relaxed/simple; bh=3OVTsEXqHjJ8xeAP69FKrRSH+6RMVGwkhMqEEaVD71Q=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=HHlxzMT6eGG3w1XQtwsGtsGiBzPcZ+eGspaCUtG4XmVbNBw9BRt5wIIZ5rXTiTuZImDdmuBSE0pEfEi23rlYro/Pwvk/q2f9lx/vkRkvUQoAi9RUfg/44fQQuVuiKRHRyN6IW4ePKdG/aHrdj+M2QlGZF7aHttQJqIlTXMMYff4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=g7znbiSO; arc=none smtp.client-ip=209.85.160.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="g7znbiSO" Received: by mail-qt1-f177.google.com with SMTP id d75a77b69052e-51788280e71so29053091cf.0 for ; Sun, 14 Jun 2026 06:11:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781442664; x=1782047464; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=skavo0y6NZljDzpBk3mdJQvAzCJLC2KJg10+24Pw1cU=; b=g7znbiSOrs/HB1q4oD/GJPKz5aLZ/h5bAIY5VlpM3AebrUioyWETuz7FtQioFnEKbF p8auEqI3ml7RIzaqPmyMpKrmJW4XgHXMu1SPTB0oRz0dVJCzrT6aU63SoC2Ak4+hHH0K 3bf7KSsVdmYXiywbVjvsT1ebE/v69oXeLHj2g+0IrsWsrz5I2C9L+cLB+jgS5ekR92Rx JrBS+Q2XfYIYxwvG0YOYswygZaQGlV5LjWoxReJHXrVtURp5CPBWop0mLD36rNpna7H1 8zxSWWeDZdSSshztLr2L5JVTwsIOA8KDB49Pp1W77TvECChVc4BNunEWb9ouaBUm7T4L z97A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781442664; x=1782047464; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=skavo0y6NZljDzpBk3mdJQvAzCJLC2KJg10+24Pw1cU=; b=mDWcLdbO9rgV90xuGsuiJctQk5CPthaLHnHlZOtbjwULRpsoh/DgXSUi1dVHJ4jLF2 nhqJsKdwMQsC6LDZ6L09v5OT+mHY+nn93Dczz1SL8hTd/JE6Tt7n0PeS9t3p7d8lGBJV lBzHPRFs+2xV7Gm1/pxOQWAn4gnDjm/AskbVd5De5CL8zi3ysY/Ts18iUikFM4b7Ixdr MikUroxPJyqLTSU7nwSH4ykwwIxvgSGEGvhQKQ2cjWtZFyJOaqVyQ/cLS82dbt6vYTi2 SY0AFoYnm+fRlvyYCvWy2W37TpmcNoGnwJ4NLNHYrjOj6X0LbvnsW+en7mOXw7mAKgDe QqIw== X-Forwarded-Encrypted: i=1; AFNElJ+tQp2o1lm0Yws9nxNM0e3/dXnRPbGCjC8JeLZp2jDLgFP6TRJl2iUshguBOziUzZTPo865jko6NkJLcQI=@vger.kernel.org X-Gm-Message-State: AOJu0YzOt/+2TkX25ROGRnuMBzIwVZ+/8NIX0Nj+SimV65lkt/qMQFLN 70F7tBoXKBt2mPbP9xd1uft+/gl9HKHABrwxl9/qHPhw7AnTIJ49+snRbgsyqRhGUW4= X-Gm-Gg: Acq92OF7Xjydgc9bHl1xE4OhJz2cX0exLHwqE6ah8C8c+KdXtPqZttrBw6OviDUjf+2 aY2MUtZb4XyVJDBiA2W7bJeX1zR19or2Pvjw/RaDIxL3IIEa3LLvoprH2wGXZQ8XJxHRFtS46X0 oC6hBF62Bf80/AnuZRSNO6iLR5sGbU5Tb68oOmIMFJCzR5Pb1KwxZGWrh4BGJICu8MX7976QKq9 EoXLIQlv8zOXj7ON41oABDVwc3Lryp2DIr/ovE5bPfHcbEr6TcRsp566aTOdnAsz4LMu5AEPeAX +08HXRUkM0Fq8Qa8FTicroOttZ2lQ1e7tPiqWr19o5yxvhmMQ7IXV682bOAdhNig45ovYQzgOoB 4UtzvjXJqQYg1C905tGI+Ez96H8gZlQQDPffTtLqzw4XdpT2IWFqP0TbMGghJ0/iA6Mk9kk8k5e 3Ur+pw+CVK4xvKtBiJJVL0HTfJXmK7nNTi6lU/vpaZ9SXL7YyjXH7wq0vFD1VcCv2GvP7oVljOv tyPzl2B9xAqd6HQIS1glLujna4GKQ1DZUQNqGKkpE4= X-Received: by 2002:ac8:7c4d:0:b0:517:7e3a:5ee1 with SMTP id d75a77b69052e-517fe18fe18mr153439521cf.1.1781442664493; Sun, 14 Jun 2026 06:11:04 -0700 (PDT) Received: from server0.tail6e7dd.ts.net (c-68-48-65-54.hsd1.mi.comcast.net. [68.48.65.54]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5196073d7fbsm25145811cf.30.2026.06.14.06.11.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Jun 2026 06:11:03 -0700 (PDT) From: Michael Bommarito To: Melissa Wen , Maira Canal Cc: Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Iago Toral Quiroga , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH 0/2] drm/v3d: bound CPU-job copy-query writes to the destination BO Date: Sun, 14 Jun 2026 09:10:58 -0400 Message-ID: <20260614131100.2525157-1-michael.bommarito@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit The V3D_SUBMIT_CPU COPY_TIMESTAMP_QUERY and COPY_PERFORMANCE_QUERY extensions take a destination offset, per-query stride and query count from userspace and consume them at job exec without checking the write extent against the destination BO. A render-node user (DRM_RENDER_ALLOW, no master, no capability) can drive a controlled-offset out-of-bounds write past the BO's vmap mapping; the timestamp variant also reads each result from an unchecked offset into the second BO. Patch 1 validates the full write extent against the BO size before the job is queued, using check_*_overflow() so a u32 product cannot wrap. Patch 2 adds a KUnit reproducer the maintainer may take or drop. Reproduced under KASAN via the KUnit over a shmem-backed BO: the trigger faults on stock and is rejected at submit on patched; two in-bounds controls pass on both. Michael Bommarito (2): drm/v3d: validate copy-query buffer bounds against destination BO size drm/v3d: add KUnit reproducer for the copy-query out-of-bounds write drivers/gpu/drm/v3d/Kconfig | 10 ++ drivers/gpu/drm/v3d/v3d_copy_query_kunit.c | 172 +++++++++++++++++++++ drivers/gpu/drm/v3d/v3d_drv.h | 3 + drivers/gpu/drm/v3d/v3d_sched.c | 4 + drivers/gpu/drm/v3d/v3d_submit.c | 86 +++++++++++ 5 files changed, 275 insertions(+) create mode 100644 drivers/gpu/drm/v3d/v3d_copy_query_kunit.c base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8 -- 2.53.0