Claude review: drm/v3d: Limit ioctl extension chain depth to prevent infinite loop

[Claude Code Review Bot <claude-review@example.com>]

Overall Series Review

Subject: drm/v3d: Limit ioctl extension chain depth to prevent infinite loop
Author: Ashutosh Desai <ashutoshdesai993@gmail.com>
Patches: 2
Reviewed: 2026-04-12T10:35:51.967853

---

This is a single-patch fix for a real denial-of-service vulnerability in the V3D DRM driver. A userspace process can craft a self-referential ioctl extension chain (where `ext->next` points back to the extension itself) that causes `v3d_get_extensions()` to loop infinitely in kernel context, permanently pegging a CPU core.

The vulnerability analysis in the commit message is correct. The existing "duplicate guard" in `v3d_get_multisync_submit_deps()` (line 391) only checks `se->in_sync_count || se->out_sync_count`, and `v3d_get_multisync_post_deps()` returns immediately at line 340 when `count` is 0 without ever setting `se->out_sync_count`. So a crafted extension with `DRM_V3D_EXT_ID_MULTI_SYNC`, zero sync counts, and `next` pointing to itself will loop forever.

The fix is sound in principle — adding a depth limit is the standard defense used by both i915 (512) and xe (16). However, there are several issues that should be addressed before merging.

---
Generated by Claude Code Patch Reviewer