An unprivileged process with access to an AMD NPU accel node can oops the
kernel with a single AMDXDNA_EXEC_CMD ioctl. Two distinct NULL dereferences
are reachable on the command-submit path, both since the driver first gained
command execution:
1. cmd_handles = 0 (AMDXDNA_INVALID_BO_HANDLE) leaves job->cmd_bo NULL,
dereferenced later by the DRM scheduler.
2. On an AIE4 device (no .cmd_submit op) the ioctl calls a NULL function
pointer.
Both are availability-only (local DoS), no memory corruption. Found by static
analysis; verified against source, not runtime-reproduced (no NPU on hand).
Doruk Tan Ozturk (2):
accel/amdxdna: reject user command submission without a command BO
accel/amdxdna: reject command submission on devices without a submit
op
drivers/accel/amdxdna/amdxdna_ctx.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--
2.43.0
