qiurui/Centos-kernel-stream-10
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git synced 2026-09-09 00:07:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

accel/amdxdna: Validate command buffer payload count

Browse Source 
JIRA: https://redhat.atlassian.net/browse/RHEL-222546
Upstream Status: v7.0-rc2
CVE: CVE-2026-23424

commit 901ec3470994006bc8dd02399e16b675566c3416
Author:     Lizhi Hou <lizhi.hou@amd.com>
AuthorDate: Thu Feb 19 13:19:46 2026 -0800
Commit:     Lizhi Hou <lizhi.hou@amd.com>
CommitDate: Mon Feb 23 09:24:21 2026 -0800

    The count field in the command header is used to determine the valid
    payload size. Verify that the valid payload does not exceed the remaining
    buffer space.

    Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
    Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
    Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
    Link: https://patch.msgid.link/20260219211946.1920485-1-lizhi.hou@amd.com

Signed-off-by: Peter Colberg <pcolberg@redhat.com>
This commit is contained in:
Peter Colberg
2026-08-20 11:10:55 -04:00
parent 15533871f6
commit bcc5331d33
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/accel/amdxdna/amdxdna_ctx.c
+4 -1
View File
@@ -104,7 +104,10 @@ void *amdxdna_cmd_get_payload(struct amdxdna_gem_obj *abo, u32 *size)
if (size) {
count = FIELD_GET(AMDXDNA_CMD_COUNT, cmd->header);
if (unlikely(count <= num_masks)) {
if (unlikely(count <= num_masks ||
count * sizeof(u32) +
offsetof(struct amdxdna_cmd, data[0]) >
abo->mem.size)) {
*size = 0;
return NULL;
}