From nobody Sat Jul 25 23:42:22 2026 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B0D79250BF2 for ; Sat, 11 Jul 2026 06:21:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783750913; cv=none; b=R0jW5hcFShug8z9kjicmJWqPud9s56LlX82hUyMtgBobmYSZoqpYhb7MmiKlaXfOVKFoQEb2/r/6ST2Bo/rB45J9ErnNXXuOKdWMXxkpoNxlv4GWooLs4x9eWUPQnwGgdH74Stqe65Arx0NlJYAaClXS6WHe31VF8Wc0gN3t+I0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783750913; c=relaxed/simple; bh=yPApT5zaushBGmZm+lvcd/QDk0UVwUXIeKhnNHREGro=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kfCq5b4zA7Frll7u4NQ2CO0Hy7BeTOl3bG1CNFbWYi8aF/6ogyZv8nCZFBzWCm/fy0gMZy5LSupevRmbaG2XPZdaTVLjnUN3QbfvU0HnX8JzLpMYyQsEzgmBPBoZOCyBSAnYN9Yxe+Z1ovPeleILvH27ED+56AsHkfrP/+v8Vlk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=furiosa.ai; spf=none smtp.mailfrom=furiosa.ai; dkim=pass (1024-bit key) header.d=furiosa.ai header.i=@furiosa.ai header.b=iNVfzodD; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=furiosa.ai Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=furiosa.ai Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=furiosa.ai header.i=@furiosa.ai header.b="iNVfzodD" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2cace7da66eso17983685ad.0 for ; Fri, 10 Jul 2026 23:21:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=furiosa.ai; s=google; t=1783750912; x=1784355712; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=MohOilWXvpBfnew3g4ppmtjZUX4BYD1OOd5Gl7wJD2A=; b=iNVfzodD8EJ8rMYioUX/Ba6SROnzzjzR6NlZhva5Dd2nypdBpvHHY5rQgRjz5F8Zj3 QFkjrP75v1KBQK14qKYtNyVkUhDU327Xr+wOfhDTCNQ69t6WuHCdv7YaNkRhOAtYpQIl v1cGSEO8j3Ar0KbUbBilPxgRkhE494UUfQg6Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783750912; x=1784355712; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MohOilWXvpBfnew3g4ppmtjZUX4BYD1OOd5Gl7wJD2A=; b=Fl9VBYDQ6H8K8bLjjNpfFYgxVrGH2ABZD6IJflmIFYIF2D6lL7QdZjXAMd6Q52l5Ci gVh9YpK+uQ5HZ3MHRrMG0iI3T5X9kjWERWo0c6fY3UlVL4oKA7wzoxOyT4DEwlSh4E+S dgwQFU+hgmPpVVXVimqEf5mMKQswHYW2iRUek+jiKgBo7+BaVCSDCxq9ObErrzBibOk5 5zEWMbT2iUGkg6qRwAjT6jnyIiHd1HyV5sN3G3bYdH+mvUhsWPbwlz9c+7yeLMenqK6z jumodciolYLsUet3fNThVrgDatuHGrZeySJH2G9bUX0OXKaB3Z9gvafxb0pq84T1/w17 qBCw== X-Forwarded-Encrypted: i=1; AHgh+Rr7ndUkxlo9IwxJdOcaeM5WYxAuUKCTGWlMu1PNK3Yah9CDn3oz46TTw3AnCNEXCSEmS3WcjPbet4ZJHXs=@vger.kernel.org X-Gm-Message-State: AOJu0Yx+6NQb+MGR66C0BWOBvto1lz3LwJ6X1tTsuCaL9UTp5dEMTE/M K1AEFIR/icUz87v9Zr9rJ1SxH/GjxYR+kseNsLlQoof2bNxGNMa7m5wTtuKdueVtvVI= X-Gm-Gg: AfdE7cnPISKRtX6r25wx5NI4+m5rcUaNEJ2M+2ksJvp7bziYSn9KN0sl0YYJQ9v7rDr xl/9vmfisMfyWEGLc0iSL4UNa6ktjZafDr9gmeLh193FJwq6yc8bqX2b9raq6VaQEtNf4jvHebV Gwv50YC+z18SpmLHUSMBvj4SZyLtfoWC3qGNWH2/Uyk5J36VnuxVSHdyDn4Xh78VuSBYzYwbAwZ SjkFzpXg31wEyh15YJzfYDCqUq27ZR0Y3ZfIB5tQG5dFF2x6PEhPdEBp03W9GP16NaDKCJkGc9a queO97lDbzdQKphDqbKjPpH6ufIjuW0J4C9eRvCbw3HdPwT0BpB2nwTUGgN4jix3FlKSwiZmM3+ LeWpB+GF0CB/VwnTtSmsSgnlJj6cc/s9W1YIb1LLs/7UO266xs/VfT1iAVEgDYfNuKEDhjhOk5/ LkljcG8vAcDtigZfScsZLv40nMFNwz0RrxwibMJh8qH2DS1w== X-Received: by 2002:a17:902:ea08:b0:2c9:e69f:8b0f with SMTP id d9443c01a7336-2ce9eabda1cmr21679715ad.17.1783750912060; Fri, 10 Jul 2026 23:21:52 -0700 (PDT) Received: from localhost.localdomain ([116.124.210.178]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ccc9bf7858sm70071775ad.23.2026.07.10.23.21.50 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 10 Jul 2026 23:21:51 -0700 (PDT) From: Sidong Yang To: Tomeu Vizoso Cc: Oded Gabbay , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Sidong Yang Subject: [PATCH] accel/rocket: Validate task regcmd address and count on submission Date: Sat, 11 Jul 2026 15:21:37 +0900 Message-ID: <20260711062137.36044-1-sidong.yang@furiosa.ai> X-Mailer: git-send-email 2.42.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The regcmd fields in drm_rocket_task come from userspace and are programmed into the PC unit without any validation. Bits 31:4 of PC_BASE_ADDRESS hold the register command DMA address and bit 0 selects slave mode, so a misaligned regcmd silently drops its low bits, and an odd address flips the PC unit into slave mode. Similarly, pc_data_amount is a 16-bit field holding (regcmd_count + 1) / 2 - 1, so a larger regcmd_count is silently truncated by the register encoding. Reject unaligned regcmd addresses and out-of-range regcmd_count with -EINVAL at submission time. Existing userspace is not affected: Mesa places regcmd buffers at 64-byte aligned offsets, and its regcmd counts stay far below the limit. Signed-off-by: Sidong Yang --- drivers/accel/rocket/rocket_job.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocke= t_job.c index bb77b6bf0f23..9ebabf86fe97 100644 --- a/drivers/accel/rocket/rocket_job.c +++ b/drivers/accel/rocket/rocket_job.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include #include @@ -21,6 +22,15 @@ =20 #define JOB_TIMEOUT_MS 500 =20 +/* + * The PC unit fetches two 64-bit register commands per pc_data_amount uni= t, + * and the field holds (regcmd_count + 1) / 2 - 1. + */ +#define ROCKET_MAX_REGCMDS ((PC_REGISTER_AMOUNTS_PC_DATA_AMOUNT__MASK + 1)= * 2U) + +/* Bits 3:0 of PC_BASE_ADDRESS hold the mode selection bit and reserved bi= ts */ +#define ROCKET_REGCMD_ALIGN 16 + static struct rocket_job * to_rocket_job(struct drm_sched_job *sched_job) { @@ -95,6 +105,20 @@ rocket_copy_tasks(struct drm_device *dev, goto fail; } =20 + if (task.regcmd_count > ROCKET_MAX_REGCMDS) { + drm_dbg(dev, "regcmd_count field in drm_rocket_task should be <=3D %u.\= n", + ROCKET_MAX_REGCMDS); + ret =3D -EINVAL; + goto fail; + } + + if (!IS_ALIGNED(task.regcmd, ROCKET_REGCMD_ALIGN)) { + drm_dbg(dev, "regcmd field in drm_rocket_task should be aligned to %u b= ytes.\n", + ROCKET_REGCMD_ALIGN); + ret =3D -EINVAL; + goto fail; + } + rjob->tasks[i].regcmd =3D task.regcmd; rjob->tasks[i].regcmd_count =3D task.regcmd_count; } base-commit: a284476db2653ae893f46cbea408eb412db54eb0 --=20 2.42.0