amdxdna_drm_sync_bo_ioctl() answers a failed amdxdna_flush_bo() with drm_WARN(). Both of that function's error returns are decided by the ioctl's arguments, so SYNC_BO with an offset past the end of the BO splats and taints the kernel from an unprivileged caller.
Log it like the pin failure above it. Signed-off-by: Taimuraz Kaitmazov <[email protected]> --- drivers/accel/amdxdna/amdxdna_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c index 77a9493cd7ba..4f38f985c74e 100644 --- a/drivers/accel/amdxdna/amdxdna_gem.c +++ b/drivers/accel/amdxdna/amdxdna_gem.c @@ -1310,7 +1310,7 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev, amdxdna_gem_unpin(abo); if (ret) { - drm_WARN(&xdna->ddev, 1, "Can not get flush memory"); + XDNA_ERR(xdna, "Flush BO %d failed, ret %d", args->handle, ret); goto put_obj; } } -- 2.55.0
