Youssef Samir ab243f74ab accel/qaic: Address potential out-of-bounds read in resp_worker() ... Although 'commit 2feec5ae5d ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker(). Reported-by: Ruikai Peng <ruikai@pwno.io> Fixes: 2feec5ae5d ("accel/qaic: Handle DBC deactivation if the owner went away") Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Lizhi Hou <lizhi.hou@amd.com> Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com> Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Link: https://patch.msgid.link/20260731152344.1905882-1-youssef.abdulrahman@oss.qualcomm.com		2026-08-14 13:09:43 -06:00
..
amdxdna	accel/amdxdna: Skip unmapped range in aie2_populate_range()	2026-08-12 23:12:20 -07:00
ethosu	Revert "accel/ethosu: Remove drm_sched_init_args->num_rqs usage"	2026-08-11 17:34:05 +01:00
habanalabs	Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses	2026-02-22 08:26:33 -08:00
ivpu	accel/ivpu: Reject firmware log with size smaller than header	2026-07-15 16:17:10 +02:00
qaic	accel/qaic: Address potential out-of-bounds read in resp_worker()	2026-08-14 13:09:43 -06:00
rocket	Revert "accel/rocket: Remove drm_sched_init_args->num_rqs usage"	2026-08-11 17:34:05 +01:00
drm_accel.c	drm: move drm based debugfs funcs to drm_debugfs.c	2025-07-04 15:58:22 +02:00
Kconfig	accel: Add Arm Ethos-U NPU driver	2025-10-24 15:07:39 -05:00
Makefile	accel: Add Arm Ethos-U NPU driver	2025-10-24 15:07:39 -05:00