Claude review: accel/amdxdna: Validate command buffer payload count

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: accel/amdxdna: Validate command buffer payload count
Author: Lizhi Hou <lizhi.hou@amd.com>
Patches: 2
Reviewed: 2026-02-23T06:27:49.749404

---

This is a single patch fixing a buffer overread vulnerability in the amdxdna accelerator driver. The `amdxdna_cmd_get_payload()` function reads a `count` field from a command header embedded in a GEM buffer object and uses it to calculate the payload size. Before this fix, the function only checked that `count > num_masks` but did not verify that the total claimed size fits within the underlying buffer. A malicious or corrupted command buffer could set a `count` value that passes the existing check but extends past the end of the allocated buffer, leading to an out-of-bounds read when callers copy or process the payload.

The fix adds a second condition to the existing validation, checking that `count * sizeof(u32) + offsetof(struct amdxdna_cmd, data[0])` does not exceed `abo->mem.size`. The arithmetic is safe from overflow since `count` is extracted from an 11-bit field (GENMASK(22, 12), max 2047), and the entire expression evaluates in `size_t` due to `sizeof(u32)` promoting the operands. The fix is minimal and targeted.

---
Generated by Claude Code Patch Reviewer