RE: [PATCH] drm/i915: Prevent heap overflow in i915_l3_write()

[Jani Nikula <jani.nikula@linux.intel.com>]

On Wed, 28 Jan 2026, "Kumar, Kaushlendra" <kaushlendra.kumar@intel.com> wrote:
> On Wed, 28 Jan 2026, Jani Nikula <jani.nikula@intel.com> wrote:
>> On Wed, 28 Jan 2026, Kaushlendra Kumar <kaushlendra.kumar@intel.com> wrote:
>>> +	count = min_t(size_t, GEN7_L3LOG_SIZE - offset, count);
>>
>> This may make count not be a multiple of sizeof(u32) again. Note how 
>> offset is treated below.
>
> Thank you for catching this!
>
> You're absolutely right about the alignment concern. While technically 
> in this specific case (GEN7_L3LOG_SIZE = 0x80, and offset is already 
> validated to be u32-aligned by l3_access_valid()), the subtraction 
> (GEN7_L3LOG_SIZE - offset) would always yield a u32-aligned result.
>
> Anything I am missing here?

No, I missed that l3_access_valid() ensures offset is already aligned.

The whole thing is a bit too convoluted for my liking, but the whole
thing matches i915_l3_read() with this patch, and there's no value in
iterating this further.

Reviewed-by: Jani Nikula <jani.nikula@intel.com>


-- 
Jani Nikula, Intel