Commit 1110a949 authored by Lizhi Hou's avatar Lizhi Hou
Browse files

accel/amdxdna: Fix out-of-bounds memset in command slot handling 



The remaining space in a command slot may be smaller than the size of
the command header. Clearing the command header with memset() before
verifying the available slot space can result in an out-of-bounds write
and memory corruption.

Fix this by moving the memset() call after the size validation.

Fixes: 3d32eb7a ("accel/amdxdna: Fix cu_idx being cleared by memset() during command setup")
Reviewed-by: default avatarMario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: default avatarLizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260217185415.1781908-1-lizhi.hou@amd.com
parent 07efce5a

drivers/accel/amdxdna/aie2_message.c

+4 −4
Original line number Diff line number Diff line
@@ -699,11 +699,11 @@ aie2_cmdlist_fill_npu_cf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *siz 
	u32 cmd_len;

	void *cmd;



	memset(npu_slot, 0, sizeof(*npu_slot));

	cmd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);

	if (*size < sizeof(*npu_slot) + cmd_len)

		return -EINVAL;



	memset(npu_slot, 0, sizeof(*npu_slot));

	npu_slot->cu_idx = amdxdna_cmd_get_cu_idx(cmd_bo);

	if (npu_slot->cu_idx == INVALID_CU_IDX)

		return -EINVAL;
@@ -724,7 +724,6 @@ aie2_cmdlist_fill_npu_dpu(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si 
	u32 cmd_len;

	u32 arg_sz;



	memset(npu_slot, 0, sizeof(*npu_slot));

	sn = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);

	arg_sz = cmd_len - sizeof(*sn);

	if (cmd_len < sizeof(*sn) || arg_sz > MAX_NPU_ARGS_SIZE)
@@ -733,6 +732,7 @@ aie2_cmdlist_fill_npu_dpu(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si 
	if (*size < sizeof(*npu_slot) + arg_sz)

		return -EINVAL;



	memset(npu_slot, 0, sizeof(*npu_slot));

	npu_slot->cu_idx = amdxdna_cmd_get_cu_idx(cmd_bo);

	if (npu_slot->cu_idx == INVALID_CU_IDX)

		return -EINVAL;
@@ -756,7 +756,6 @@ aie2_cmdlist_fill_npu_preempt(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t 
	u32 cmd_len;

	u32 arg_sz;



	memset(npu_slot, 0, sizeof(*npu_slot));

	pd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);

	arg_sz = cmd_len - sizeof(*pd);

	if (cmd_len < sizeof(*pd) || arg_sz > MAX_NPU_ARGS_SIZE)
@@ -765,6 +764,7 @@ aie2_cmdlist_fill_npu_preempt(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t 
	if (*size < sizeof(*npu_slot) + arg_sz)

		return -EINVAL;



	memset(npu_slot, 0, sizeof(*npu_slot));

	npu_slot->cu_idx = amdxdna_cmd_get_cu_idx(cmd_bo);

	if (npu_slot->cu_idx == INVALID_CU_IDX)

		return -EINVAL;
@@ -792,7 +792,6 @@ aie2_cmdlist_fill_npu_elf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si 
	u32 cmd_len;

	u32 arg_sz;



	memset(npu_slot, 0, sizeof(*npu_slot));

	pd = amdxdna_cmd_get_payload(cmd_bo, &cmd_len);

	arg_sz = cmd_len - sizeof(*pd);

	if (cmd_len < sizeof(*pd) || arg_sz > MAX_NPU_ARGS_SIZE)
@@ -801,6 +800,7 @@ aie2_cmdlist_fill_npu_elf(struct amdxdna_gem_obj *cmd_bo, void *slot, size_t *si 
	if (*size < sizeof(*npu_slot) + arg_sz)

		return -EINVAL;



	memset(npu_slot, 0, sizeof(*npu_slot));

	npu_slot->type = EXEC_NPU_TYPE_ELF;

	npu_slot->inst_buf_addr = pd->inst_buf;

	npu_slot->save_buf_addr = pd->save_buf;