> amdxdna_drm_sync_bo_ioctl() passes the caller's offset and size to > drm_clflush_virt_range() on the BO's kernel mapping without checking > either against the BO size. The ioctl has no permission flags: any
Queued for 6.18, thanks. -- Thanks, Sasha
