Commit 901ec347 authored by Lizhi Hou's avatar Lizhi Hou
Browse files

accel/amdxdna: Validate command buffer payload count 



The count field in the command header is used to determine the valid
payload size. Verify that the valid payload does not exceed the remaining
buffer space.

Fixes: aac24309 ("accel/amdxdna: Add command execution")
Reviewed-by: default avatarMario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: default avatarLizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260219211946.1920485-1-lizhi.hou@amd.com
parent 03808abb

drivers/accel/amdxdna/amdxdna_ctx.c

+4 −1
Original line number Diff line number Diff line
@@ -104,7 +104,10 @@ void *amdxdna_cmd_get_payload(struct amdxdna_gem_obj *abo, u32 *size) 


	if (size) {

		count = FIELD_GET(AMDXDNA_CMD_COUNT, cmd->header);

		if (unlikely(count <= num_masks)) {

		if (unlikely(count <= num_masks ||

			     count * sizeof(u32) +

			     offsetof(struct amdxdna_cmd, data[0]) >

			     abo->mem.size)) {

			*size = 0;

			return NULL;

		}