On 8/17/26 16:07, Taimuraz Kaitmazov wrote:

amdxdna_drm_sync_bo_ioctl() answers a failed amdxdna_flush_bo() with drm_WARN(). Both of that function's error returns are decided by the ioctl's arguments, so SYNC_BO with an offset past the end of the BO splats and taints the kernel from an unprivileged caller.

Log it like the pin failure above it.

Signed-off-by: Taimuraz Kaitmazov taimuraz@kaitmazov.com

drivers/accel/amdxdna/amdxdna_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c index 77a9493cd7ba..4f38f985c74e 100644 --- a/drivers/accel/amdxdna/amdxdna_gem.c +++ b/drivers/accel/amdxdna/amdxdna_gem.c @@ -1310,7 +1310,7 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev, amdxdna_gem_unpin(abo); if (ret) {

• 	drm_WARN(&xdna->ddev, 1, "Can not get flush memory");
  

• 	XDNA_ERR(xdna, "Flush BO %d failed, ret %d", args->handle, ret);
  

Should it be XDNA_DBG?

Lizhi

	goto put_obj;
}

}