[PATCH V1] accel/amdxdna: Validate command buffer payload count

[Lizhi Hou]

The count field in the command header is used to determine the valid
payload size. Verify that the valid payload does not exceed the remaining
buffer space.

Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
Signed-off-by: Lizhi Hou <lizhi....@amd.com>
---
 drivers/accel/amdxdna/amdxdna_ctx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c 
b/drivers/accel/amdxdna/amdxdna_ctx.c
index d17aef89a0ad..cf4d3af67bf7 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.c
+++ b/drivers/accel/amdxdna/amdxdna_ctx.c
@@ -104,7 +104,10 @@ void *amdxdna_cmd_get_payload(struct amdxdna_gem_obj *abo, 
u32 *size)
 
        if (size) {
                count = FIELD_GET(AMDXDNA_CMD_COUNT, cmd->header);
-               if (unlikely(count <= num_masks)) {
+               if (unlikely(count <= num_masks ||
+                            count * sizeof(u32) +
+                            offsetof(struct amdxdna_cmd, data[0]) >
+                            abo->mem.size)) {
                        *size = 0;
                        return NULL;
                }
-- 
2.34.1