Re: [PATCH] accel/qaic: reject BO sizes that overflow page count

On 7/7/2026 9:19 PM, Hao-Qun Huang wrote:
> create_sgt() receives the BO size as a u64 but stores the number of
> pages in an int. qaic_create_bo_ioctl() page-aligns the user-supplied
> size without an upper bound, so DIV_ROUND_UP(size, PAGE_SIZE) can exceed
> INT_MAX and truncate when assigned to nr_pages.
> 
> When the page count wraps to a small positive value (for example a BO
> larger than 16 TiB on a 4 KiB page kernel), create_sgt() succeeds after
> allocating only a handful of pages while the GEM object still records
> the full size, so the request never fails with -ENOMEM. The temporary
> pages array and the allocation loop both use the truncated count, so the
> backing SG table ends up smaller than obj->size. Later slice operations
> validate against obj->size and then clone ranges from this short sgt.
> 
> Compute the page count as a u64 and reject sizes that do not fit in
> nr_pages before the narrowing conversion.
> 
> Fixes: ff13be830333 ("accel/qaic: Add datapath")
> Assisted-by: Claude:claude-fable-5
> Signed-off-by: Hao-Qun Huang <[email protected]>

Applied to drm-misc-next

-Jeff