Re: [PATCH v2] accel/qaic: Address potential out-of-bounds read in resp_worker()
Jeff Hugo <[email protected]>
| Newsgroups | org.kernel.vger.linux-arm-msm,org.freedesktop.lists.dri-devel |
|---|---|
| Message-ID | <[email protected]> |
On 7/31/2026 9:23 AM, Youssef Samir wrote:
> Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the
> owner went away")' fixes the scenario it was intended for by walking the
> message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it
> skipped over the bounds checking code that is included in decode_message().
> This could lead to issues such as reading past the slab allocation's end,
> infinite loops or kernel panics. For those issues to happen, a malformed
> wire message is needed to be sent from the device.
>
> Instead of duplicating the bounds checking code already present in
> decode_message(), use the function inside resp_worker().
>
> Reported-by: Ruikai Peng <[email protected]>
> Fixes: 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")
> Reviewed-by: Jeff Hugo <[email protected]>
> Reviewed-by: Lizhi Hou <[email protected]>
> Signed-off-by: Youssef Samir <[email protected]>
Applied to drm-misc-fixes.
-Jeff