fix BO offset and size check #956
Conversation
Signed-off-by: Max Zhen <max.zhen@amd.com>
There was a problem hiding this comment.
Pull request overview
This PR fixes a buffer overflow validation issue in the AMDXDNA driver's sync_bo ioctl handler. The original check was insufficient to prevent integer overflow when adding offset and size.
Key Changes:
- Enhanced validation in
amdxdna_drm_sync_bo_ioctlto check offset and size individually before checking their sum - Added guards against integer overflow in buffer bounds validation
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| if (gobj->size < args->offset + args->size) { | ||
| if (gobj->size < args->offset || | ||
| gobj->size < args->size || | ||
| args->offset > gobj->size - args->size) { |
There was a problem hiding this comment.
minor, just to keep this line consistent to the above two lines, maybe change it to gobj->size < args->offset + args->size
There was a problem hiding this comment.
this is done to avoid overflow from args->offset + args->size. gobj->size - args->size is safe since line 1215 has done the check.
4 participants
No description provided.