mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-13 05:34:06 -04:00
Code Issues Packages Projects Releases Wiki Activity

accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

Browse Source 
struct amdxdna_cmd_chain contains a flexible array annotated with
__counted_by(command_count). Since the structure is stored in shared
AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently.
If command_count is changed to zero, the bounds check generated from
__counted_by may fail and trigger a kernel panic.

Remove __counted_by to avoid relying on the userspace-controlled
command_count for the flexible array bounds check.

Fixes: aac243092b ("accel/amdxdna: Add command execution")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260821033543.1839719-1-lizhi.hou@amd.com
This commit is contained in:
Lizhi Hou
2026-08-20 20:35:43 -07:00
parent 8985cbc927
commit b3709d3545
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/accel/amdxdna/amdxdna_ctx.h
View File

@@ -55,7 +55,7 @@ struct amdxdna_cmd_chain {
u32 submit_index;
u32 error_index;
u32 reserved[3];
u64 data[] __counted_by(command_count);
u64 data[];
};
/*