On 8/17/26 16:07, Taimuraz Kaitmazov wrote:
amdxdna_drm_sync_bo_ioctl() answers a failed amdxdna_flush_bo() with drm_WARN(). Both of that function's error returns are decided by the ioctl's arguments, so SYNC_BO with an offset past the end of the BO splats and taints the kernel from an unprivileged caller.
Log it like the pin failure above it.
Signed-off-by: Taimuraz Kaitmazov taimuraz@kaitmazov.com
drivers/accel/amdxdna/amdxdna_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c index 77a9493cd7ba..4f38f985c74e 100644 --- a/drivers/accel/amdxdna/amdxdna_gem.c +++ b/drivers/accel/amdxdna/amdxdna_gem.c @@ -1310,7 +1310,7 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev, amdxdna_gem_unpin(abo); if (ret) {
drm_WARN(&xdna->ddev, 1, "Can not get flush memory");
XDNA_ERR(xdna, "Flush BO %d failed, ret %d", args->handle, ret);
Should it be XDNA_DBG?
Lizhi
goto put_obj; }}