Re: [PATCH v2 1/3] accel/rocket: Validate BO handle counts on job submission

[Sidong Yang]

On Fri, Aug 28, 2026 at 01:06:06AM +0800, MoGGuU wrote:
> The input and output BO handle counts are __u32, while GEM lookup and
> reservation helpers take int counts. A count above INT_MAX, or a combined
> count above INT_MAX, cannot be represented safely at those call sites.
> 
> Reject such counts before looking up the BOs.
> 
> Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
> Cc: stable@xxxxxxxxxxxxxxx
> Tested-by: Sidong Yang <sidong.yang@xxxxxxxxxx>
> Signed-off-by: MoGGuU <Naixumogu@xxxxxxxxxxx>
> ---
>  drivers/accel/rocket/rocket_job.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c
> index bb77b6bf0f231..7e3d123afc5ad 100644
> --- a/drivers/accel/rocket/rocket_job.c
> +++ b/drivers/accel/rocket/rocket_job.c
> @@ -556,6 +556,12 @@ static int rocket_ioctl_submit_job(struct drm_device *dev, struct drm_file *file
>  	if (job->task_count == 0)
>  		return -EINVAL;
>  
> +	/* GEM lookup and reservation helpers take signed object counts. */
> +	if (job->in_bo_handle_count > INT_MAX ||
> +	    job->out_bo_handle_count > INT_MAX ||
> +	    job->in_bo_handle_count > INT_MAX - job->out_bo_handle_count)

I think checking in/out is okay but the sum of in/out would be checked with check_add_overflow()
in rocket_job_push(). But it only caches overflow UINT_MAX because bo_count is u32. It seems that it
would be good to change bo_count to int.
ㅏ

> +		return -EINVAL;
> +
>  	rjob = kzalloc_obj(*rjob);
>  	if (!rjob)
>  		return -ENOMEM;
> -- 
> 2.43.0
>