On 8/17/26 16:07, Taimuraz Kaitmazov wrote:
amdxdna_drm_sync_bo_ioctl() answers a failed amdxdna_flush_bo() with
drm_WARN(). Both of that function's error returns are decided by the
ioctl's arguments, so SYNC_BO with an offset past the end of the BO
splats and taints the kernel from an unprivileged caller.
Log it like the pin failure above it.
Signed-off-by: Taimuraz Kaitmazov <[email protected]>
---
drivers/accel/amdxdna/amdxdna_gem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/accel/amdxdna/amdxdna_gem.c
b/drivers/accel/amdxdna/amdxdna_gem.c
index 77a9493cd7ba..4f38f985c74e 100644
--- a/drivers/accel/amdxdna/amdxdna_gem.c
+++ b/drivers/accel/amdxdna/amdxdna_gem.c
@@ -1310,7 +1310,7 @@ int amdxdna_drm_sync_bo_ioctl(struct drm_device *dev,
amdxdna_gem_unpin(abo);
if (ret) {
- drm_WARN(&xdna->ddev, 1, "Can not get flush memory");
+ XDNA_ERR(xdna, "Flush BO %d failed, ret %d",
args->handle, ret);
Should it be XDNA_DBG?
Lizhi
goto put_obj;
}
}
