Integer overflow in AMD XDNA driver

[saifuddin-xilinx]

No description provided.

[Copilot]

Pull request overview

This PR addresses an integer overflow vulnerability in the AMD XDNA driver's buffer object (BO) creation function by adding input validation for the size parameter before it undergoes page alignment.

Changes:

• Added validation to reject zero-size BO creation requests
• Added overflow check to prevent integer overflow when PAGE_ALIGN is applied to the size parameter

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

These two validation checks could be combined into a single conditional statement to reduce code duplication and improve readability. Consider using a single if statement that checks both conditions with an OR operator, or extract the validation logic into a helper function if this pattern is reused elsewhere in the codebase.

Suggested change

	if (args->size == 0) {
	XDNA_ERR(xdna, "Invalid zero size for BO creation");
	return -EINVAL;
	}
	if (args->size > SIZE_MAX - (PAGE_SIZE - 1)) {
	XDNA_ERR(xdna, "Size 0x%llx would overflow PAGE_ALIGN", args->size);
	return -EINVAL;
	}
	if (args->size == 0 || args->size > SIZE_MAX - (PAGE_SIZE - 1)) {
	if (args->size == 0)
	XDNA_ERR(xdna, "Invalid zero size for BO creation");
	else
	XDNA_ERR(xdna, "Size 0x%llx would overflow PAGE_ALIGN", args->size);
	return -EINVAL;
	}

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.