Re: [PATCH V1] accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

[Max Zhen]

On 8/20/2026 Thu 20:35, Lizhi Hou wrote:
> struct amdxdna_cmd_chain contains a flexible array annotated with
> __counted_by(command_count). Since the structure is stored in shared
> AMDXDNA_BO_SHARE memory, userspace can modify command_count concurrently.
> If command_count is changed to zero, the bounds check generated from
> __counted_by may fail and trigger a kernel panic.
>
> Remove __counted_by to avoid relying on the userspace-controlled
> command_count for the flexible array bounds check.
>
> Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
> Signed-off-by: Lizhi Hou <lizhi.hou@xxxxxxx>
Reviewed-by: Max Zhen <max.zhen@xxxxxxx>
> ---
>   drivers/accel/amdxdna/amdxdna_ctx.h | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_ctx.h b/drivers/accel/amdxdna/amdxdna_ctx.h
> index e6155f4b5db0..010538cb05a3 100644
> --- a/drivers/accel/amdxdna/amdxdna_ctx.h
> +++ b/drivers/accel/amdxdna/amdxdna_ctx.h
> @@ -56,7 +56,7 @@ struct amdxdna_cmd_chain {
>   	u32 submit_index;
>   	u32 error_index;
>   	u32 reserved[3];
> -	u64 data[] __counted_by(command_count);
> +	u64 data[];
>   };
>   
>   /*