drm/xe: Validate user fence during creation

Fail invalid addresses during user fence creation.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240717140429.1396820-1-matthew.brost@intel.com

diff --git a/drivers/gpu/drm/xe/xe_sync.c b/drivers/gpu/drm/xe/xe_sync.c
index 2883d9aca404e658d6bf182bc2489ae3f9fc8db5..f2e5e3c8c0cddd8d9f7f869fd64f4b46ec708272 100644 (file)
--- a/drivers/gpu/drm/xe/xe_sync.c
+++ b/drivers/gpu/drm/xe/xe_sync.c
@@ -53,14 +53,18 @@ static struct xe_user_fence *user_fence_create(struct xe_device *xe, u64 addr,
                                               u64 value)
 {
        struct xe_user_fence *ufence;
+       u64 __user *ptr = u64_to_user_ptr(addr);
+
+       if (!access_ok(ptr, sizeof(ptr)))
+               return ERR_PTR(-EFAULT);
 
        ufence = kmalloc(sizeof(*ufence), GFP_KERNEL);
        if (!ufence)
-               return NULL;
+               return ERR_PTR(-ENOMEM);
 
        ufence->xe = xe;
        kref_init(&ufence->refcount);
-       ufence->addr = u64_to_user_ptr(addr);
+       ufence->addr = ptr;
        ufence->value = value;
        ufence->mm = current->mm;
        mmgrab(ufence->mm);
@@ -183,8 +187,8 @@ int xe_sync_entry_parse(struct xe_device *xe, struct xe_file *xef,
                } else {
                        sync->ufence = user_fence_create(xe, sync_in.addr,
                                                         sync_in.timeline_value);
-                       if (XE_IOCTL_DBG(xe, !sync->ufence))
-                               return -ENOMEM;
+                       if (XE_IOCTL_DBG(xe, IS_ERR(sync->ufence)))
+                               return PTR_ERR(sync->ufence);
                }
 
                break;