[PATCH 0/2] accel/amdxdna: fix two NULL-deref DoS paths reachable via AMDXDNA_EXEC_CMD

[Doruk Tan Ozturk <doruk@0sec.ai>]

An unprivileged process with access to an AMD NPU accel node can oops the
kernel with a single AMDXDNA_EXEC_CMD ioctl. Two distinct NULL dereferences
are reachable on the command-submit path, both since the driver first gained
command execution:

  1. cmd_handles = 0 (AMDXDNA_INVALID_BO_HANDLE) leaves job->cmd_bo NULL,
     dereferenced later by the DRM scheduler.
  2. On an AIE4 device (no .cmd_submit op) the ioctl calls a NULL function
     pointer.

Both are availability-only (local DoS), no memory corruption. Found by static
analysis; verified against source, not runtime-reproduced (no NPU on hand).


Doruk Tan Ozturk (2):
  accel/amdxdna: reject user command submission without a command BO
  accel/amdxdna: reject command submission on devices without a submit
    op

 drivers/accel/amdxdna/amdxdna_ctx.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

-- 
2.43.0