Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] accel/amdxdna: missing capability check for REALTIME priority allows DoS --
commit 33aba925e30324fed055cc90f6f20b1a9826f931 Author: David Zhang <[email protected]> accel/amdxdna: Support firmware 6.0 This commit supports firmware interface version 6.0 by updating the host queue layout, opcode definitions, and context creation/destruction request structures. It also parses priority band and PASID for hardware context creation. > diff --git a/drivers/accel/amdxdna/aie4_ctx.c > b/drivers/accel/amdxdna/aie4_ctx.c > index 8157f2a6fd10a..5eb918e1d58c7 100644 > --- a/drivers/accel/amdxdna/aie4_ctx.c > +++ b/drivers/accel/amdxdna/aie4_ctx.c [ ... ] > @@ -110,6 +111,22 @@ static int aie4_msg_destroy_context(struct > amdxdna_dev_hdl *ndev, u32 hw_context > return aie_send_mgmt_msg_wait(&ndev->aie, &msg); > } > > +static u8 aie4_parse_priority_to_dev(u32 priority) > +{ > + switch (priority) { > + case AMDXDNA_QOS_LOW_PRIORITY: > + return AIE4_CONTEXT_PRIORITY_BAND_IDLE; > + case AMDXDNA_QOS_NORMAL_PRIORITY: > + return AIE4_CONTEXT_PRIORITY_BAND_NORMAL; > + case AMDXDNA_QOS_HIGH_PRIORITY: > + return AIE4_CONTEXT_PRIORITY_BAND_FOCUS; > + case AMDXDNA_QOS_REALTIME_PRIORITY: > + return AIE4_CONTEXT_PRIORITY_BAND_REAL_TIME; [Severity: Medium] Could this allow an unprivileged user to monopolize the NPU? In aie4_parse_priority_to_dev() in drivers/accel/amdxdna/aie4_ctx.c, when a user calls the AMDXDNA_CREATE_HWCTX ioctl and passes AMDXDNA_QOS_REALTIME_PRIORITY in qos.priority, this maps directly to AIE4_CONTEXT_PRIORITY_BAND_REAL_TIME during context creation and is sent to the firmware. Since there doesn't appear to be a capability check (such as verifying if the caller possesses CAP_SYS_NICE or similar privileges), could any local user with access to the DRM node create an NPU hardware context with REALTIME priority and starve other workloads, causing a denial of service? > + default: > + return AIE4_CONTEXT_PRIORITY_BAND_NORMAL; > + } > +} -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
