Skip to content

Bug bounty fix #9953

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
saifuddin-xilinx wants to merge 12 commits into
base: master
Choose a base branch
from
Open

Bug bounty fix #9953

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
8eb03b9
zocl: fix stack buffer overflow in cu_conf2info()
saifuddin-xilinx Jul 31, 2026
3dbc329
ci: handle large-PR 406 error in clangtidy-review workflow
Copilot Jul 31, 2026
4fe611f
xocl: fix use-after-free in ert_ctrl_abort_sync()
saifuddin-xilinx Jul 31, 2026
67a840e
xocl: restrict PREAD/PWRITE_UNMGD IOCTLs to CAP_SYS_ADMIN
saifuddin-xilinx Aug 2, 2026
b2b8cd3
xocl/zocl: fix stack overflow in cu_ctx_to_info() CU name parsing
saifuddin-xilinx Aug 2, 2026
dcb9105
xocl: restore ert_ctrl_alloc_ert_xgq and ert_ctrl_legacy_init; remove…
saifuddin-xilinx Aug 3, 2026
771ccf3
xocl: restore deleted functions and remove stray artifact in ert_ctrl.c
saifuddin-xilinx Aug 3, 2026
4a82571
xocl: restore PL CU match logic in xocl_cu_ctx_to_info()
saifuddin-xilinx Aug 3, 2026
ebd4473
zocl: restore PL CU match logic in zocl_cu_ctx_to_info()
saifuddin-xilinx Aug 3, 2026
2c13dcc
xocl: fix EACCES->EPERM and remove dangling code in pread_unmgd_ioctl
saifuddin-xilinx Aug 3, 2026
9f8fe04
revert: remove unrelated CI change from BugBounty_Fix
saifuddin-xilinx Aug 3, 2026
2b7760e
revert: restore clangtidy-review.yml to exact master content
saifuddin-xilinx Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions src/runtime_src/core/edge/drm/zocl/edge/zocl_hwctx.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,14 +98,20 @@ static int zocl_cu_ctx_to_info(struct drm_zocl_dev *zdev, struct drm_zocl_open_c
{
uint32_t slot_hndl = kds_hw_ctx->slot_idx;
struct kds_sched *kds = &zdev->kds;
char *kname_p = drm_cu_ctx->cu_name;
char name[CU_NAME_MAX_LEN + 1];
char *kname_p = name;
char *token;
struct xrt_cu *xcu = NULL;
char iname[CU_NAME_MAX_LEN];
char kname[CU_NAME_MAX_LEN];
int i = 0;

strcpy(kname, strsep(&kname_p, ":"));
strcpy(iname, strsep(&kname_p, ":"));
memcpy(name, drm_cu_ctx->cu_name, CU_NAME_MAX_LEN);
name[CU_NAME_MAX_LEN] = '\0';
token = strsep(&kname_p, ":");
strscpy(kname, token ? token : "", sizeof(kname));
token = strsep(&kname_p, ":");
strscpy(iname, token ? token : "", sizeof(iname));

/* Retrive the CU index from the given slot */
for (i = 0; i < MAX_CUS; i++) {
Expand Down
13 changes: 10 additions & 3 deletions src/runtime_src/core/edge/drm/zocl/zert/zocl_ctrl_ert.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,12 @@ static inline u32 reg_read(void __iomem *base, u64 off)

static void cu_conf2info(struct xgq_cmd_config_cu *conf, struct xrt_cu_info *info)
{
char *kname_p = conf->name;
char name[sizeof(conf->name) + 1];
char *kname_p = name;
char *token;

memcpy(name, conf->name, sizeof(conf->name));
name[sizeof(conf->name)] = 0;

memset(info, 0, sizeof(*info));
info->num_res = 1;
Expand All @@ -176,8 +181,10 @@ static void cu_conf2info(struct xgq_cmd_config_cu *conf, struct xrt_cu_info *inf
info->model = XCU_HLS;
info->cu_domain = conf->cu_domain;
info->cu_idx = conf->cu_idx;
strcpy(info->kname, strsep(&kname_p, ":"));
strcpy(info->iname, strsep(&kname_p, ":"));
token = strsep(&kname_p, ":");
strscpy(info->kname, token ? token : "", sizeof(info->kname));
token = strsep(&kname_p, ":");
strscpy(info->iname, token ? token : "", sizeof(info->iname));
memcpy(info->uuid, conf->uuid, sizeof(info->uuid));
}

Expand Down
39 changes: 39 additions & 0 deletions src/runtime_src/core/pcie/driver/linux/xocl/subdev/ert_ctrl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -493,6 +493,45 @@ static void ert_ctrl_submit_exit_cmd(struct ert_ctrl *ec)

static bool ert_ctrl_abort_sync(struct kds_ert *ert, struct kds_client *client, int cu_idx)
{
struct kds_client_hw_ctx *hw_ctx;
unsigned long submitted = 0, completed = 0;
int timeout_ms = 5000;

/* Sum submitted and completed counts across all hw contexts */
list_for_each_entry(hw_ctx, &client->hw_ctx_list, link) {
int i;

for (i = 0; i < MAX_CUS; i++) {
submitted += stat_read(hw_ctx->stats, s_cnt[i]);
submitted += stat_read(hw_ctx->stats, scu_s_cnt[i]);
completed += stat_read(hw_ctx->stats, c_cnt[i]);
completed += stat_read(hw_ctx->stats, scu_c_cnt[i]);
}
}

if (submitted == completed)
return false;

/* Wait for in-flight commands to drain before client is freed */
do {
msleep(500);
timeout_ms -= 500;
submitted = 0;
completed = 0;
list_for_each_entry(hw_ctx, &client->hw_ctx_list, link) {
int i;

for (i = 0; i < MAX_CUS; i++) {
submitted += stat_read(hw_ctx->stats, s_cnt[i]);
submitted += stat_read(hw_ctx->stats, scu_s_cnt[i]);
completed += stat_read(hw_ctx->stats, c_cnt[i]);
completed += stat_read(hw_ctx->stats, scu_c_cnt[i]);
}
}
if (submitted == completed)
return false;
} while (timeout_ms > 0);

return true;
}

Expand Down
31 changes: 8 additions & 23 deletions src/runtime_src/core/pcie/driver/linux/xocl/userpf/xocl_bo.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1470,7 +1470,7 @@ static bool xocl_validate_paddr(struct xocl_dev *xdev, u64 paddr, u64 size)
#endif

int xocl_pwrite_unmgd_ioctl(struct drm_device *dev, void *data,
struct drm_file *filp)
struct drm_file *filp)
{
const struct drm_xocl_pwrite_unmgd *args = data;
struct xocl_drm *drm_p = dev->dev_private;
Expand All @@ -1482,27 +1482,19 @@ int xocl_pwrite_unmgd_ioctl(struct drm_device *dev, void *data,
return -EFAULT;
}

if (!capable(CAP_SYS_ADMIN))
return -EPERM;

if (args->size == 0)
return 0;

/* currently we are not able to return error because
* it is unclear that what addresses are valid other than
* ddr area. we should revisit this sometime.
* if (!xocl_validate_paddr(xdev, args->paddr, args->size)) {
* userpf_err(xdev, "invalid paddr: 0x%llx, size:0x%llx",
* args->paddr, args->size);
* return -EINVAL;
* }
*/


ret = xocl_migrate_unmgd(xdev, args->data_ptr, args->paddr, args->size, 1);

return ret;
}

int xocl_pread_unmgd_ioctl(struct drm_device *dev, void *data,
struct drm_file *filp)
struct drm_file *filp)
{
const struct drm_xocl_pwrite_unmgd *args = data;
struct xocl_drm *drm_p = dev->dev_private;
Expand All @@ -1514,19 +1506,12 @@ int xocl_pread_unmgd_ioctl(struct drm_device *dev, void *data,
return -EFAULT;
}

if (!capable(CAP_SYS_ADMIN))
return -EPERM;

if (args->size == 0)
return 0;

/* currently we are not able to return error because
* it is unclear that what addresses are valid other than
* ddr area. we should revisit this sometime.
* if (!xocl_validate_paddr(xdev, args->paddr, args->size)) {
* userpf_err(xdev, "invalid paddr: 0x%llx, size:0x%llx",
* args->paddr, args->size);
* return -EINVAL;
* }
*/

ret = xocl_migrate_unmgd(xdev, args->data_ptr, args->paddr, args->size, 0);

return ret;
Expand Down
12 changes: 9 additions & 3 deletions src/runtime_src/core/pcie/driver/linux/xocl/userpf/xocl_hwctx.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,14 +109,20 @@ xocl_cu_ctx_to_info(struct xocl_dev *xdev, struct drm_xocl_open_cu_ctx *cu_args,
{
uint32_t slot_hndl = hw_ctx->slot_idx;
struct kds_sched *kds = &XDEV(xdev)->kds;
char *kname_p = cu_args->cu_name;
char name[CU_NAME_MAX_LEN + 1];
char *kname_p = name;
char *token;
struct xrt_cu *xcu = NULL;
char iname[CU_NAME_MAX_LEN];
char kname[CU_NAME_MAX_LEN];
int i = 0;

strcpy(kname, strsep(&kname_p, ":"));
strcpy(iname, strsep(&kname_p, ":"));
memcpy(name, cu_args->cu_name, CU_NAME_MAX_LEN);
name[CU_NAME_MAX_LEN] = '\0';
token = strsep(&kname_p, ":");
strscpy(kname, token ? token : "", sizeof(kname));
token = strsep(&kname_p, ":");
strscpy(iname, token ? token : "", sizeof(iname));

/* Retrieve the CU index from the given slot */
for (i = 0; i < MAX_CUS; i++) {
Expand Down
Loading