* [PATCH V1] accel/amdxdna: Validate command buffer payload count
@ 2026-02-19 21:19 Lizhi Hou
2026-02-20 17:03 ` Mario Limonciello (AMD) (kernel.org)
0 siblings, 1 reply; 2+ messages in thread
From: Lizhi Hou @ 2026-02-19 21:19 UTC (permalink / raw)
To: ogabbay, quic_jhugo, dri-devel, maciej.falkowski
Cc: Lizhi Hou, linux-kernel, max.zhen, sonal.santan, mario.limonciello
The count field in the command header is used to determine the valid
payload size. Verify that the valid payload does not exceed the remaining
buffer space.
Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
drivers/accel/amdxdna/amdxdna_ctx.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
index d17aef89a0ad..cf4d3af67bf7 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.c
+++ b/drivers/accel/amdxdna/amdxdna_ctx.c
@@ -104,7 +104,10 @@ void *amdxdna_cmd_get_payload(struct amdxdna_gem_obj *abo, u32 *size)
if (size) {
count = FIELD_GET(AMDXDNA_CMD_COUNT, cmd->header);
- if (unlikely(count <= num_masks)) {
+ if (unlikely(count <= num_masks ||
+ count * sizeof(u32) +
+ offsetof(struct amdxdna_cmd, data[0]) >
+ abo->mem.size)) {
*size = 0;
return NULL;
}
--
2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH V1] accel/amdxdna: Validate command buffer payload count
2026-02-19 21:19 [PATCH V1] accel/amdxdna: Validate command buffer payload count Lizhi Hou
@ 2026-02-20 17:03 ` Mario Limonciello (AMD) (kernel.org)
0 siblings, 0 replies; 2+ messages in thread
From: Mario Limonciello (AMD) (kernel.org) @ 2026-02-20 17:03 UTC (permalink / raw)
To: Lizhi Hou, ogabbay, quic_jhugo, dri-devel, maciej.falkowski
Cc: linux-kernel, max.zhen, sonal.santan
On 2/19/2026 3:19 PM, Lizhi Hou wrote:
> The count field in the command header is used to determine the valid
> payload size. Verify that the valid payload does not exceed the remaining
> buffer space.
>
> Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
> ---
> drivers/accel/amdxdna/amdxdna_ctx.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
> index d17aef89a0ad..cf4d3af67bf7 100644
> --- a/drivers/accel/amdxdna/amdxdna_ctx.c
> +++ b/drivers/accel/amdxdna/amdxdna_ctx.c
> @@ -104,7 +104,10 @@ void *amdxdna_cmd_get_payload(struct amdxdna_gem_obj *abo, u32 *size)
>
> if (size) {
> count = FIELD_GET(AMDXDNA_CMD_COUNT, cmd->header);
> - if (unlikely(count <= num_masks)) {
> + if (unlikely(count <= num_masks ||
> + count * sizeof(u32) +
> + offsetof(struct amdxdna_cmd, data[0]) >
> + abo->mem.size)) {
> *size = 0;
> return NULL;
> }
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-02-20 17:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-02-19 21:19 [PATCH V1] accel/amdxdna: Validate command buffer payload count Lizhi Hou
2026-02-20 17:03 ` Mario Limonciello (AMD) (kernel.org)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®