Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
accel/amdxdna: Validate command buffer payload count
The count field in the command header is used to determine the valid
payload size. Verify that the valid payload does not exceed the remaining
buffer space.
Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260219211946.1920485-1-lizhi.hou@amd.com
+4
-1
+4
-1
drivers/accel/amdxdna/amdxdna_ctx.c
+4
-1
drivers/accel/amdxdna/amdxdna_ctx.c
···
104
104
105
105
if (size) {
106
106
count = FIELD_GET(AMDXDNA_CMD_COUNT, cmd->header);
107
-
if (unlikely(count <= num_masks)) {
107
+
if (unlikely(count <= num_masks ||
108
+
count * sizeof(u32) +
109
+
offsetof(struct amdxdna_cmd, data[0]) >
110
+
abo->mem.size)) {
108
111
*size = 0;
109
112
return NULL;
110
113
}