From nobody Fri Jul 24 23:31:27 2026 Received: from cstnet.cn (smtp25.cstnet.cn [159.226.251.25]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C72593F23AF for ; Wed, 22 Jul 2026 04:21:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.25 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784694093; cv=none; b=j1Gey5Z99lPQJb1C/d9xOpF3Drac2OcC9HUnqS1Cq7pTWjUb+PvcRFefy3ZftXzDAZQvu92T/R1bjt6p9/XbNFL22oCks/9f51vWrIZ2gf+7uRorGTywMFdv3mDG2BBum4H/XL2JPgsZvhxMpSV+5LBWNdKdCeXHG0bKJhKJ4cg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784694093; c=relaxed/simple; bh=cXoLo2agNFJjsTWb6t88KgL0C5KcTjahCsEYhDl4vtk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Wt7nek8zFc7aLGtDV2Z5sLLqfowmRcUOfMzdIgY5O0nSn+eS/f2gkCq9KsZfRKEFkyVvebOpPUJ0o4sPXoPdQRJI4q4NkI6iU/wJYugm1ZJoenkaqxReuAXjsmjSb13ejrYQg0LqPeyuusVpkuBNzffYDVhq15k9NhT/Ycl3EHE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.245.140]) by APP-05 (Coremail) with SMTP id zQCowAAHdT9DRWBqREu7AA--.23709S2; Wed, 22 Jul 2026 12:21:23 +0800 (CST) From: Pengpeng Hou To: Lyude Paul Cc: Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH] drm/nouveau/gsp: validate sequencer command span Date: Wed, 22 Jul 2026 12:21:23 +0800 Message-ID: <20260722042123.39900-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zQCowAAHdT9DRWBqREu7AA--.23709S2 X-Coremail-Antispam: 1UD129KBjvJXoWxJryfXFW5KrW3Xw4rWF4UArb_yoW5JF1Upr s5G3WFyFWDWa1xJFyxAF15Xa4Yy34vya43Cr9rZryDAFs7JrW0yr1Utr4Yv34Sgr4fC34F yF95GayxuryUG3DanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9S14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26ryj6F1UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVWxJr0_GcWl84ACjcxK6I8E87Iv6xkF7I0E14v26F 4UJVW0owAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv 7VC0I7IYx2IY67AKxVWUtVWrXwAv7VC2z280aVAFwI0_Gr0_Cr1lOx8S6xCaFVCjc4AY6r 1j6r4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02 628vn2kIc2xKxwCY1x0262kKe7AKxVWUtVW8ZwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4 IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1r MI8E67AF67kF1VAFwI0_Jw0_GFylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVW8JV W5JwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr1j6F4UJwCI42IY6xAIw20EY4v20xvaj40_ Jr0_JF4lIxAIcVC2z280aVAFwI0_Gr0_Cr1lIxAIcVC2z280aVCY1x0267AKxVW8Jr0_Cr 1UYxBIdaVFxhVjvjDU0xZFpf9x0JUDOz3UUUUU= X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ Content-Type: text/plain; charset="utf-8" The GSP sequencer RPC contains a variable command stream. The handler currently walks commands using the stream header length without first proving that the stream, each command payload, or a register-save slot fits in the received RPC and its fixed save area. Validate the stream and each command against the RPC payload before walking it, and reject register-save indexes beyond the fixed save array. Signed-off-by: Pengpeng Hou --- .../drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c | 22 +++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c b/driver= s/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c index f544afa12b6b..00417bbccc12 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c @@ -1010,15 +1010,30 @@ r535_gsp_msg_run_cpu_sequencer(void *priv, u32 fn, = void *repv, u32 repc) struct nvkm_subdev *subdev =3D &gsp->subdev; struct nvkm_device *device =3D subdev->device; rpc_run_cpu_sequencer_v17_00 *seq =3D repv; - int ptr =3D 0, ret; + u32 ptr =3D 0, payload; + int ret; + + if (repc < offsetof(rpc_run_cpu_sequencer_v17_00, commandBuffer) || + seq->cmdIndex > + (repc - offsetof(rpc_run_cpu_sequencer_v17_00, commandBuffer)) / + sizeof(seq->commandBuffer[0])) { + nvkm_error(subdev, "invalid sequencer command buffer size\n"); + return -EINVAL; + } =20 nvkm_debug(subdev, "seq: %08x %08x\n", seq->bufferSizeDWord, seq->cmdInde= x); =20 while (ptr < seq->cmdIndex) { GSP_SEQUENCER_BUFFER_CMD *cmd =3D (void *)&seq->commandBuffer[ptr]; =20 + payload =3D GSP_SEQUENCER_PAYLOAD_SIZE_DWORDS(cmd->opCode); + if (seq->cmdIndex - ptr < payload + 1) { + nvkm_error(subdev, "truncated sequencer command\n"); + return -EINVAL; + } + ptr +=3D 1; - ptr +=3D GSP_SEQUENCER_PAYLOAD_SIZE_DWORDS(cmd->opCode); + ptr +=3D payload; =20 switch (cmd->opCode) { case GSP_SEQ_BUF_OPCODE_REG_WRITE: { @@ -1064,6 +1079,9 @@ r535_gsp_msg_run_cpu_sequencer(void *priv, u32 fn, vo= id *repv, u32 repc) u32 addr =3D cmd->payload.regStore.addr; u32 slot =3D cmd->payload.regStore.index; =20 + if (slot >=3D ARRAY_SIZE(seq->regSaveArea)) + return -EINVAL; + seq->regSaveArea[slot] =3D nvkm_rd32(device, addr); nvkm_trace(subdev, "seq save %08x -> %d: %08x\n", addr, slot, seq->regSaveArea[slot]); --=20 2.43.0