Re: [PATCH V1] accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
Max Zhen <[email protected]>
| Newsgroups | org.freedesktop.lists.dri-devel,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On 8/20/2026 Thu 20:35, Lizhi Hou wrote:
> struct amdxdna_cmd_chain contains a flexible array annotated with
> __counted_by(command_count). Since the structure is stored in shared
> AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently.
> If command_count is changed to zero, the bounds check generated from
> __counted_by may fail and trigger a kernel panic.
>
> Remove __counted_by to avoid relying on the userspace-controlled
> command_count for the flexible array bounds check.
>
> Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
> Signed-off-by: Lizhi Hou <[email protected]>
Reviewed-by: Max Zhen <[email protected]>
> ---
> drivers/accel/amdxdna/amdxdna_ctx.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_ctx.h b/drivers/accel/amdxdna/amdxdna_ctx.h
> index e6155f4b5db0..010538cb05a3 100644
> --- a/drivers/accel/amdxdna/amdxdna_ctx.h
> +++ b/drivers/accel/amdxdna/amdxdna_ctx.h
> @@ -56,7 +56,7 @@ struct amdxdna_cmd_chain {
> u32 submit_index;
> u32 error_index;
> u32 reserved[3];
> - u64 data[] __counted_by(command_count);
> + u64 data[];
> };
>
> /*