Pengpeng Hou 45585c3aa2 drm/imagination: clamp freelist reconstruction requests ... The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the count to those protocol arrays. Clamp the count to the request capacity, which is shared by the response layout, and use that count consistently for reconstruction and response publication. Keep the firmware recovery exchange instead of dropping an oversized request without a response, as discussed with the firmware maintainer. The issue was found by our static-analysis tool. Fixes: 6eedddab73 ("drm/imagination: Implement free list and HWRT create and destroy ioctls") Assisted-by: gpt 5 Signed-off-by: Pengpeng Hou <hppiscas@163.com> Reviewed-by: Alessio Belle <alessio.belle@imgtec.com> Link: https://patch.msgid.link/20260920034329.16614-1-hppiscas@163.com Signed-off-by: Brajesh Gupta <brajesh.gupta@imgtec.com>		2026-09-24 14:59:22 +05:30
..
Kconfig	drm/imagination: KUnit test for pvr_gpuid_decode_string()	2026-01-19 11:20:22 +00:00
Makefile	drm/imagination: Add support for trace points	2026-05-19 12:47:19 +01:00
pvr_ccb.c	drm/imagination: Fix repeated typo in KCCB documentation	2026-08-06 15:49:09 +01:00
pvr_ccb.h
pvr_cccb.c
pvr_cccb.h
pvr_check.h	drm/imagination: Move all FW interface check macros to pvr_checks.h	2026-08-03 11:21:13 +01:00
pvr_context.c	drm/imagination: fix error checking of pvr_vm_context_lookup()	2026-07-09 15:07:32 +01:00
pvr_context.h
pvr_debugfs.c	drm/imagination: Simplify module parameters	2026-01-19 11:20:21 +00:00
pvr_debugfs.h
pvr_device_info.c
pvr_device_info.h	drm/imagination: Reorder some fields in struct pvr_device_features	2026-07-31 09:26:53 +01:00
pvr_device.c	drm/imagination: promote BXM-4-64 MC1 (36.52.104.182) to supported status	2026-07-24 08:37:01 +01:00
pvr_device.h	drm/imagination: Use dev_pm_domain_attach_list()	2026-02-06 10:18:30 +00:00
pvr_drv.c	drm/imagination: promote BXM-4-64 MC1 (36.52.104.182) to supported status	2026-07-24 08:37:01 +01:00
pvr_drv.h
pvr_dump.c	drm/imagination: Implement handling of context reset notification	2026-03-24 08:22:21 +00:00
pvr_dump.h	drm/imagination: Implement handling of context reset notification	2026-03-24 08:22:21 +00:00
pvr_free_list.c	drm/imagination: clamp freelist reconstruction requests	2026-09-24 14:59:22 +05:30
pvr_free_list.h
pvr_fw_info.h
pvr_fw_meta.c
pvr_fw_meta.h
pvr_fw_mips.c
pvr_fw_mips.h
pvr_fw_riscv.c
pvr_fw_startstop.c	drm/imagination: Skip 2nd thread DM association for non META Firmware	2026-03-23 15:02:05 +00:00
pvr_fw_startstop.h
pvr_fw_trace.c	drm/imagination: make pvr_fw_trace_init_mask_ops static	2026-07-09 15:07:23 +01:00
pvr_fw_trace.h	drm/imagination: Simplify module parameters	2026-01-19 11:20:21 +00:00
pvr_fw_util.c
pvr_fw.c	drm/imagination: Access FW initialised state with READ/WRITE_ONCE	2026-05-19 12:40:15 +01:00
pvr_fw.h	drm/imagination: Rename FW booted to FW initialised	2026-05-19 12:40:15 +01:00
pvr_gem.c	drm/gem-shmem: Track folio accessed/dirty status in vmap	2026-03-11 09:33:43 +01:00
pvr_gem.h	drm/imagination: fixup some docs in pvr_gem.h	2026-08-06 15:49:09 +01:00
pvr_hwrt.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
pvr_hwrt.h
pvr_job.c	drm/imagination: Add support for trace points	2026-05-19 12:47:19 +01:00
pvr_job.h
pvr_mmu.c	drm/imagination: Fix page count for page table for map() interface	2026-09-24 14:56:48 +05:30
pvr_mmu.h	drm/imagination: Fix page count for page table for map() interface	2026-09-24 14:56:48 +05:30
pvr_power.c	power: sequencing: rename pwrseq_power_on/off() to pwrseq_enable/disable()	2026-08-26 10:05:45 +02:00
pvr_power.h	drm/imagination: Discard pm_runtime_put() return value	2026-01-08 15:19:15 +01:00
pvr_queue.c	Linux 7.2	2026-08-20 10:58:44 +10:00
pvr_queue.h	drm/imagination: Fix double call to drm_sched_entity_fini()	2026-07-02 11:15:35 +01:00
pvr_rogue_cr_defs_client.h
pvr_rogue_cr_defs.h
pvr_rogue_defs.h
pvr_rogue_fwif_check.h	drm/imagination: Move all FW interface check macros to pvr_checks.h	2026-08-03 11:21:13 +01:00
pvr_rogue_fwif_client_check.h	drm/imagination: Move all FW interface check macros to pvr_checks.h	2026-08-03 11:21:13 +01:00
pvr_rogue_fwif_client.h
pvr_rogue_fwif_common.h
pvr_rogue_fwif_dev_info.h
pvr_rogue_fwif_resetframework.h
pvr_rogue_fwif_sf.h
pvr_rogue_fwif_shared_check.h	drm/imagination: Move all FW interface check macros to pvr_checks.h	2026-08-03 11:21:13 +01:00
pvr_rogue_fwif_shared.h	drm/imagination: Minor improvements to job submission code documentation	2026-04-08 11:17:14 +01:00
pvr_rogue_fwif_stream.h
pvr_rogue_fwif.h	drm/imagination: Switch reset_reason fields from enum to u32	2026-03-24 08:19:59 +00:00
pvr_rogue_heap_config.h	drm/imagination: Update Rogue heap comments	2026-08-06 15:49:09 +01:00
pvr_rogue_meta.h
pvr_rogue_mips_check.h	drm/imagination: Reuse layout check macros for MIPS FW structures	2026-08-03 11:25:42 +01:00
pvr_rogue_mips.h
pvr_rogue_mmu_defs.h
pvr_rogue_riscv.h
pvr_stream_defs.c
pvr_stream_defs.h
pvr_stream.c
pvr_stream.h
pvr_sync.c	drm/imagination: Rename fence returned by pvr_queue_job_arm()	2026-04-08 11:17:13 +01:00
pvr_sync.h	drm/imagination: Rename fence returned by pvr_queue_job_arm()	2026-04-08 11:17:13 +01:00
pvr_test.c	drm/imagination: KUnit test for pvr_gpuid_decode_string()	2026-01-19 11:20:22 +00:00
pvr_trace_points.c	drm/imagination: Add support for trace points	2026-05-19 12:47:19 +01:00
pvr_trace.h	drm/imagination: Fix value of HWRT address in pvr_job_create tracepoint	2026-07-24 08:46:18 +01:00
pvr_vm_mips.c
pvr_vm_mips.h
pvr_vm.c	drm/imagination: Fix page count for page table for map() interface	2026-09-24 14:56:48 +05:30
pvr_vm.h