diff options
| author | Lizhi Hou <lizhi.hou@amd.com> | 2026-08-20 20:35:43 -0700 |
|---|---|---|
| committer | Lizhi Hou <lizhi.hou@amd.com> | 2026-08-24 09:29:41 -0700 |
| commit | b3709d354545e70388177500761f92d906c4dfd6 (patch) | |
| tree | a5f2388203dc03d25de8eca5d2fe9758afd5cf99 /drivers/accel | |
| parent | 8985cbc927fd3e23dfebaa099ae0b6d2b38d3258 (diff) | |
| download | linux-next-b3709d354545e70388177500761f92d906c4dfd6.tar.gz linux-next-b3709d354545e70388177500761f92d906c4dfd6.zip | |
accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
struct amdxdna_cmd_chain contains a flexible array annotated with
__counted_by(command_count). Since the structure is stored in shared
AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently.
If command_count is changed to zero, the bounds check generated from
__counted_by may fail and trigger a kernel panic.
Remove __counted_by to avoid relying on the userspace-controlled
command_count for the flexible array bounds check.
Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Reviewed-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260821033543.1839719-1-lizhi.hou@amd.com
Diffstat (limited to 'drivers/accel')
| -rw-r--r-- | drivers/accel/amdxdna/amdxdna_ctx.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.h b/drivers/accel/amdxdna/amdxdna_ctx.h index b6bef3af7dab..6e78bab8a02c 100644 --- a/drivers/accel/amdxdna/amdxdna_ctx.h +++ b/drivers/accel/amdxdna/amdxdna_ctx.h @@ -55,7 +55,7 @@ struct amdxdna_cmd_chain { u32 submit_index; u32 error_index; u32 reserved[3]; - u64 data[] __counted_by(command_count); + u64 data[]; }; /* |