On 8/20/2026 Thu 20:35, Lizhi Hou wrote:
struct amdxdna_cmd_chain contains a flexible array annotated with
__counted_by(command_count). Since the structure is stored in shared
AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently.
If command_count is changed to zero, the bounds check generated from
__counted_by may fail and trigger a kernel panic.
Remove __counted_by to avoid relying on the userspace-controlled
command_count for the flexible array bounds check.
Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Signed-off-by: Lizhi Hou <[email protected]>
Reviewed-by: Max Zhen <[email protected]>
---
drivers/accel/amdxdna/amdxdna_ctx.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/accel/amdxdna/amdxdna_ctx.h
b/drivers/accel/amdxdna/amdxdna_ctx.h
index e6155f4b5db0..010538cb05a3 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.h
+++ b/drivers/accel/amdxdna/amdxdna_ctx.h
@@ -56,7 +56,7 @@ struct amdxdna_cmd_chain {
u32 submit_index;
u32 error_index;
u32 reserved[3];
- u64 data[] __counted_by(command_count);
+ u64 data[];
};
/*
