On Fri, Aug 28, 2026 at 02:19:14PM +0800, MoGGuU wrote:
> The input and output BO handle counts are __u32, while GEM lookup and
> reservation helpers take int counts. A count above INT_MAX cannot be
> represented safely by the GEM lookup helper.
>
> Reject each count above INT_MAX before looking up the BOs.
>
> rocket_job_push() already uses check_add_overflow() for the combined count,
> but stores the result in u32, so it only detects unsigned wraparound. Store
> the result in int so sums above INT_MAX are rejected before the count is
> passed to the reservation helpers.
>
> Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
> Cc: [email protected]
> Tested-by: Sidong Yang <[email protected]>
> Reviewed-by: Sidong Yang <[email protected]>
> Signed-off-by: MoGGuU <[email protected]>
Real name please.
thanks,
greg k-h
