Re: [PATCH 2/2] accel/amdxdna: reject command submission on devices without a submit op

[Lizhi Hou <lizhi.hou@amd.com>]

Applied to drm-misc-fixes

On 7/14/26 18:00, Lizhi Hou wrote:
>
> On 7/13/26 10:30, Doruk Tan Ozturk wrote:
>> amdxdna_cmd_submit() calls xdna->dev_info->ops->cmd_submit()
>> unconditionally, but only aie2_dev_ops defines that callback.
>> aie4_vf_ops (the AIE4 SR-IOV virtual function) does not, so a user
>> AMDXDNA_EXEC_CMD ioctl on an AIE4 device reaches a NULL function-pointer
>> call and oopses the kernel. AIE4 submits work through a mapped user 
>> queue
>> and doorbell, not this ioctl path.
>>
>> Reject the submission early with -EOPNOTSUPP when the device provides no
>> cmd_submit op, so the shared EXEC ioctl is a clean no-op on such 
>> devices.
>>
>> Fixes: aac243092b70 ("accel/amdxdna: Add command execution")
>> Cc: stable@vger.kernel.org
>> Found by 0sec automated security-research tooling (https://0sec.ai).
>> Assisted-by: 0sec:claude-opus-4-8
>> Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
>> ---
>>   drivers/accel/amdxdna/amdxdna_ctx.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c 
>> b/drivers/accel/amdxdna/amdxdna_ctx.c
>> index a5c8c2c4de6d..bdbd3db12a6c 100644
>> --- a/drivers/accel/amdxdna/amdxdna_ctx.c
>> +++ b/drivers/accel/amdxdna/amdxdna_ctx.c
>> @@ -590,6 +590,10 @@ int amdxdna_cmd_submit(struct amdxdna_client 
>> *client,
>>       int ret, idx;
>>         XDNA_DBG(xdna, "Command BO hdl %d, Arg BO count %d", 
>> cmd_bo_hdl, arg_bo_cnt);
>> +
>> +    if (!xdna->dev_info->ops->cmd_submit)
>> +        return -EOPNOTSUPP;
>> +
> Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
>>       job = kzalloc_flex(*job, bos, arg_bo_cnt);
>>       if (!job)
>>           return -ENOMEM;