Re: [PATCH v2] accel/qaic: Address potential out-of-bounds read in resp_worker()

Jeff Hugo <[email protected]>
Newsgroups org.kernel.vger.linux-arm-msm,org.freedesktop.lists.dri-devel
Message-ID <[email protected]>
On 7/31/2026 9:23 AM, Youssef Samir wrote:
> Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the
> owner went away")' fixes the scenario it was intended for by walking the
> message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it
> skipped over the bounds checking code that is included in decode_message().
> This could lead to issues such as reading past the slab allocation's end,
> infinite loops or kernel panics. For those issues to happen, a malformed
> wire message is needed to be sent from the device.
> 
> Instead of duplicating the bounds checking code already present in
> decode_message(), use the function inside resp_worker().
> 
> Reported-by: Ruikai Peng <[email protected]>
> Fixes: 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")
> Reviewed-by: Jeff Hugo <[email protected]>
> Reviewed-by: Lizhi Hou <[email protected]>
> Signed-off-by: Youssef Samir <[email protected]>

Applied to drm-misc-fixes.

-Jeff
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.