Muhammad Bilal aecd00c33b accel/qaic: use sizeof(*trans_hdr) for transaction length check ...

[ Upstream commit d6c075f797 ]

In encode_message() the per-transaction lower-bound check compares
trans_hdr->len against sizeof(trans_hdr), i.e. the size of the pointer,
instead of sizeof(*trans_hdr), the size of struct qaic_manage_trans_hdr.

Every other length check in this file (encode_message() at the loop
guard, decode_message(), etc.) correctly uses sizeof(*trans_hdr), so
this is an inconsistency. On 64-bit builds the pointer and the struct
are both 8 bytes, so the check is correct by coincidence and there is
no behavioural change. On 32-bit builds the pointer is 4 bytes, which
weakens the minimum-length check below the 8-byte header size.

Use sizeof(*trans_hdr) so the check validates against the actual
transaction header size on all builds.

Fixes: ea33cb6fc2 ("accel/qaic: tighten bounds checking in encode_message()")
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://patch.msgid.link/20260617212520.59801-1-meatuni001@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-08-09 20:21:50 +02:00

..

habanalabs

accel/habanalabs: support mapping cb with vmalloc-backed coherent memory

2025-11-24 10:29:44 +01:00

ivpu

accel/ivpu: Reject firmware log with size smaller than header

2026-08-03 11:15:11 +02:00

qaic

accel/qaic: use sizeof(*trans_hdr) for transaction length check

2026-08-09 20:21:50 +02:00

drm_accel.c

…

Kconfig

…

Makefile

…