github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

accel: ethosu: Validate SRAM size on submit

Browse Source 
Regions with a BO are checked against the BO size, but the SRAM
region is not. The SRAM region doesn't have a BO, but the command stream
region size should be checked against the SRAM size. The job's
"sram_size" isn't useful here because an evil userspace could lie about
the size.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20260513185434.1667045-1-robh@kernel.org
Signed-off-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
Reviewed-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
This commit is contained in:
Rob Herring (Arm) 2026-05-13 13:54:34 -05:00 committed by Tomeu Vizoso
parent 4c26e16294
commit 9cff907748
1 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/accel/ethosu/ethosu_job.c
View File

@ -416,9 +416,21 @@ static int ethosu_ioctl_submit_job(struct drm_device *dev, struct drm_file *file
struct drm_gem_object *gem; struct drm_gem_object *gem;
/* Can only omit a BO handle if the region is not used or used for SRAM */ /* Can only omit a BO handle if the region is not used or used for SRAM */
if (!job->region_bo_handles[i] && if (!job->region_bo_handles[i]) {
(!cmd_info->region_size[i] || (i == ETHOSU_SRAM_REGION && job->sram_size))) if (!cmd_info->region_size[i])
continue; continue;
if (i == ETHOSU_SRAM_REGION) {
if (cmd_info->region_size[i] <= edev->npu_info.sram_size)
continue;
dev_err(dev->dev,
"cmd stream region %d size greater than SRAM size (%llu > %u)\n",
i, cmd_info->region_size[i],
edev->npu_info.sram_size);
ret = -EINVAL;
goto out_cleanup_job;
}
}
if (job->region_bo_handles[i] && !cmd_info->region_size[i]) { if (job->region_bo_handles[i] && !cmd_info->region_size[i]) {
dev_err(dev->dev, dev_err(dev->dev,