Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-14 Thread Christian König
Am 13.04.25 um 13:31 schrieb Fedor Pchelkin: > On Thu, 10. Apr 11:07, Christian König wrote: >> Am 09.04.25 um 19:27 schrieb Linus Torvalds: >>> The VM layer allows larger allocations. But the "this is a simple >>> allocation, choose kmalloc or vmalloc automatically based on size" >>> helper says "

Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-14 Thread Fedor Pchelkin
On Thu, 10. Apr 11:07, Christian König wrote: > Am 09.04.25 um 19:27 schrieb Linus Torvalds: > > The VM layer allows larger allocations. But the "this is a simple > > allocation, choose kmalloc or vmalloc automatically based on size" > > helper says "you are being simple, I'm going to check your ar

Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-10 Thread Christian König
Am 09.04.25 um 04:39 schrieb Linus Torvalds: > On Tue, 8 Apr 2025 at 09:07, Fedor Pchelkin wrote: >>> Linus comment is about kvmalloc(), but the code here is using >>> kvmalloc_array() which as far as I know is explicitly made to safely >>> allocate arrays with parameters provided by userspace. >

Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-10 Thread Linus Torvalds
On Wed, 9 Apr 2025 at 00:29, Christian König wrote: > > I mean open coding the limit checks everywhere certainly works, but as far as > I can see it would be more defensive if we do that inside kvmalloc_array(). No. If we add some limit to kvmalloc_array(), I guarantee that people will just the

Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-10 Thread Christian König
Am 09.04.25 um 19:27 schrieb Linus Torvalds: > On Wed, 9 Apr 2025 at 00:29, Christian König wrote: >> I mean open coding the limit checks everywhere certainly works, but as far >> as I can see it would be more defensive if we do that inside >> kvmalloc_array(). > No. > > If we add some limit to

Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-09 Thread Linus Torvalds
On Tue, 8 Apr 2025 at 09:07, Fedor Pchelkin wrote: > > > Linus comment is about kvmalloc(), but the code here is using > > kvmalloc_array() which as far as I know is explicitly made to safely > > allocate arrays with parameters provided by userspace. No. ABSOLUTELY NOTHING CAN ALLOCATE ARRAYS WI

Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-08 Thread Fedor Pchelkin
On Tue, 08. Apr 11:26, Christian König wrote: > Am 08.04.25 um 11:17 schrieb Denis Arefev: > > The user can set any value to the variable ‘bo_number’, via the ioctl > > command DRM_IOCTL_AMDGPU_BO_LIST. This will affect the arithmetic > > expression ‘in->bo_number * in->bo_info_size’, which is pron

Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-08 Thread Fedor Pchelkin
On Tue, 08. Apr 14:22, Christian König wrote: > Am 08.04.25 um 13:54 schrieb Fedor Pchelkin: > > If user can request an arbitrary size value then we should use __GFP_NOWARN > > and back on the allocator to return NULL in case it doesn't even try to > > satisfy an enormous memory allocation request

Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-08 Thread Fedor Pchelkin
On Tue, 08. Apr 13:37, Christian König wrote: > Am 08.04.25 um 11:39 schrieb Fedor Pchelkin: > > On Tue, 08. Apr 11:26, Christian König wrote: > >> Am 08.04.25 um 11:17 schrieb Denis Arefev: > >>> The user can set any value to the variable ‘bo_number’, via the ioctl > >>> command DRM_IOCTL_AMDGPU_B

Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-08 Thread Christian König
Am 08.04.25 um 13:54 schrieb Fedor Pchelkin: > If user can request an arbitrary size value then we should use __GFP_NOWARN > and back on the allocator to return NULL in case it doesn't even try to > satisfy an enormous memory allocation request (in which case it yells in > the log without __GFP_NOW

Re: [lvc-project] [PATCH] drm/amdgpu: check a user-provided number of BOs in list

2025-04-08 Thread Christian König
Am 08.04.25 um 11:39 schrieb Fedor Pchelkin: > On Tue, 08. Apr 11:26, Christian König wrote: >> Am 08.04.25 um 11:17 schrieb Denis Arefev: >>> The user can set any value to the variable ‘bo_number’, via the ioctl >>> command DRM_IOCTL_AMDGPU_BO_LIST. This will affect the arithmetic >>> expression ‘