Re: [PATCH v4 1/3] accel/rocket: Validate BO handle counts on job submission

[Greg KH]

On Fri, Aug 28, 2026 at 02:19:14PM +0800, MoGGuU wrote:
> The input and output BO handle counts are __u32, while GEM lookup and
> reservation helpers take int counts. A count above INT_MAX cannot be
> represented safely by the GEM lookup helper.
> 
> Reject each count above INT_MAX before looking up the BOs.
> 
> rocket_job_push() already uses check_add_overflow() for the combined count,
> but stores the result in u32, so it only detects unsigned wraparound. Store
> the result in int so sums above INT_MAX are rejected before the count is
> passed to the reservation helpers.
> 
> Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
> Cc: stable@xxxxxxxxxxxxxxx
> Tested-by: Sidong Yang <sidong.yang@xxxxxxxxxx>
> Reviewed-by: Sidong Yang <sidong.yang@xxxxxxxxxx>
> Signed-off-by: MoGGuU <Naixumogu@xxxxxxxxxxx>

Real name please.

thanks,

greg k-h