On 8/19/26 15:44, Taimuraz Kaitmazov wrote:
amdxdna_drm_sync_bo_ioctl() answers a failed amdxdna_flush_bo() with drm_WARN(). Both of that function's error returns are decided by the ioctl's arguments, so SYNC_BO with an offset past the end of the BO splats and taints the kernel from an unprivileged caller.
Log it at debug level, since the same caller can repeat it.
Signed-off-by: Taimuraz Kaitmazov taimuraz@kaitmazov.com
drivers/accel/amdxdna/amdxdna_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c index 77a9493cd7ba..0e0f844526ca 100644 --- a/drivers/accel/amdxdna/amdxdna_gem.c +++ b/drivers/accel/amdxdna/amdxdna_gem.c @@ -1310,7 +1310,7 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev, amdxdna_gem_unpin(abo); if (ret) {
drm_WARN(&xdna->ddev, 1, "Can not get flush memory");
XDNA_DBG(xdna, "Flush BO %d failed, ret %d", args->handle, ret);
Reviewed-by: Lizhi Hou lizhi.hou@amd.com
goto put_obj; }}