github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

accel/rocket: Use an unsigned index to copy the job's tasks

Browse Source 
task_count is a u32 from userspace, but rocket_copy_tasks() walks it
with an int index, which would overflow for counts above INT_MAX. That
is not reachable today, since kvmalloc_objs() rejects any count above
INT_MAX / 16, but use an unsigned index to match the type.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260711063638.61B411F000E9@smtp.kernel.org/
Signed-off-by: Sidong Yang <sidong.yang@furiosa.ai>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Link: https://patch.msgid.link/20261004164727.466164-3-sidong.yang@furiosa.ai
This commit is contained in:
Sidong Yang 2026-10-05 01:47:26 +09:00 committed by Heiko Stuebner
parent a6709a58a0
commit f31a7b1f27
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/accel/rocket/rocket_job.c
View File

@ -78,7 +78,7 @@ rocket_copy_tasks(struct drm_device *dev,
return -ENOMEM;
}
for (int i = 0; i < rjob->task_count; i++) {
for (unsigned int i = 0; i < rjob->task_count; i++) {
struct drm_rocket_task task = {0};
if (copy_from_user(&task,