From nobody Sat Jul 25 18:01:02 2026 Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 17538389472 for ; Wed, 15 Jul 2026 07:42:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784101335; cv=none; b=ICgoQDrx+o5rLARnwnTLxa8UNuus5CasUHJkBGrE1DP+/2g49R7oTXO9WGuxSU/TnYHLZqk5PWn2NcnWIAEPt/MLALivNSdzo2AZveICB4nCU5zSxAIo1T50oiB532bfTi3XG5OCK78f6mx/KWyG/rUIdTajzS3jHxaqs+c+Dqk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784101335; c=relaxed/simple; bh=tLbK1LaytGCVKI6VJaOlumBFobdlE/A4U/0p5Y9BX0g=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LfACAKOtNxXBSjxiNmdQoarYbDPEffD2aHNKXnnnYBOOymEIlISK1A6euuOSsv8TBREg1pc+Dr5+XHtldHMmNUK632ldPWYFjsdtETpgR6d1XOhZZyTrxOlbPT2dOiLmBBfvLriBPxJ44/FoRd8a+x38UCmKbEaUz1zxdBNBBWA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=boZQyPa2; arc=none smtp.client-ip=209.85.215.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="boZQyPa2" Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-ca12086c06eso4343544a12.0 for ; Wed, 15 Jul 2026 00:42:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784101333; x=1784706133; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=v/9XWaR3xNGls/DnkUkxuqsc1d9ZqSJqTwvyT8BBonI=; b=boZQyPa2c/IULAJP7K60KDR3HSHYsiCmqmmxcBHTU2kdLmSgxrzizoKzQnDxll1wRN sC+GaFv+jYyA35XNN2A/z9sPNZEqQVAqB9kzQvtq63DxJ1WEAHAa3RWMVHKal5SqrX1c T9z4X5cz7m4A2XxoA9Im+4/xc6WJdRMGSbpGF+v7OuNejHZhoJ/5ATxIkaO5mn/xyfz9 HIS330BmDhwsdzpm4Ol7UScn0bOWaLpw7BTEWQzTjsQ/skMO6KimKb53GvEvVGpa5BXo MbpqCMDUMj4j1BVV3Z4gBX284I9+WweqdkVUJGotf/x9Y7VLZYLlK1lw9OXfe/4HoZvv L1cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784101333; x=1784706133; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=v/9XWaR3xNGls/DnkUkxuqsc1d9ZqSJqTwvyT8BBonI=; b=TWJSyEhDzyaTtPB52SsC0gLEe3me0BPuiTS3zbZ0sQ7NnRkI7SVTcCCSiHt3mj4vAv oHj4vky+2wGOddB0PM45Hlde/qsn+TM+cCV0KQ8oqCBlfLEJweBH3AMEAWFM8u0YzIfi ic642svvUhz14jo/C3TqmgwXrTMQmD4zrbrpfmxxtNS2N+SJtzVCg5mrdMiHoobNvAU6 R4hBAHg+K1H0eza5YMbtRApTrMZ58k9YIX13Iw2t6KLbFIqnPo5mGv4bESiAIDev7O+m HijhAQqKH8McnjTUHJhxYchmN/ReZ2HarKn/GOCo4vNShHtfdZadWiUCBp7rH4O88SbG /qbg== X-Forwarded-Encrypted: i=1; AHgh+RoB1LLElbBl8ARvhfYPL3wOuhLAcOsnkUC21sGW77y2HbHZeGf3SnudZ9qWgX6KKnoQCBwmzNu62KC/ZbI=@vger.kernel.org X-Gm-Message-State: AOJu0YxlSXekHuIgmNeIZnsw6rNz5m6hFUN82L/IIk1gUWOLzAfo04GA PL7XsbOX5a4j+eB3tapenHAt5OKAXfGR/JcWk5j+AkS+ZHKJ0hhCm0W3 X-Gm-Gg: AfdE7cn/4wxqKN9/7lS+OfTRGh763r/23RwhaF5hBwdopRhpiv1BqjN9Dw8l8EOEPIx ADBbc9xNMM/46HhV9QOl82tRKx8Dtg6ECzL/IO9T1sJpXtJpjPos3AwYGLVJ/CIyLGDFamPAZex Jo6zd6pqJ+zenY7LShdHWBkx9laiLjOFW4LZYvqqSV/A3LIlxJ4sbHl6oHwKZuG1xK8lBHdPagJ XjfcPDvbYF3yEXFtDjodvFjbyg3zXJphMh2tPRMi0a/lf0SBu4V7joKzjP4opcwKHFOGeotwA51 frz2clhFd8VxQ+OaYR2oa6xeEirukvHFTLEIpg4e6ylTVcyFu8fPBAW8BrvkQ/74Vu02eR2tIIn L2Q0gYEv8Fnd7PDTskdZjt51dPG1EGdhTh+Qps7WuzX77lwZJKse33YiUUF1DGzo2bSoYZdlh5a zFjv+q+7+JOVMGK/7nM5Y= X-Received: by 2002:a05:6300:2208:b0:3a0:b781:4c78 with SMTP id adf61e73a8af0-3c36c0f6ea9mr2095219637.15.1784101333320; Wed, 15 Jul 2026 00:42:13 -0700 (PDT) Received: from lenovo-thinkbook ([1.22.231.74]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13cd22ec3cbsm829255c88.15.2026.07.15.00.42.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jul 2026 00:42:12 -0700 (PDT) From: Jhonraushan To: Karol Wachowski , Andrzej Kacprowski , Oded Gabbay Cc: Jacek Lawrynowicz , Stanislaw Gruszka , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Jhonraushan Subject: [PATCH] accel/ivpu: Reject firmware log with size smaller than header Date: Wed, 15 Jul 2026 13:12:06 +0530 Message-ID: <20260715074206.867712-1-raushan.jhon@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" fw_log_from_bo() validates the tracing buffer header_size and that the log fits within the BO, but never checks that log->size is at least log->header_size. fw_log_print_buffer() then computes: u32 data_size =3D log->size - log->header_size; which underflows to a near-U32_MAX value when firmware reports a log whose size is smaller than its header. That huge data_size defeats the log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu: Add bounds checks for firmware log indices"), so fw_log_print_lines() reads far past the small real data region of the BO. A size of 0 also makes fw_log_from_bo() advance the offset by 0, causing the callers to loop forever on the same header. Reject logs whose size is smaller than the header (which also rejects size =3D=3D 0). Fixes: d4e4257afa6e ("accel/ivpu: Add firmware tracing support") Cc: stable@vger.kernel.org Signed-off-by: Jhonraushan Reviewed-by: Karol Wachowski --- drivers/accel/ivpu/ivpu_fw_log.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/accel/ivpu/ivpu_fw_log.c b/drivers/accel/ivpu/ivpu_fw_= log.c index 275baf844b56..716467aa3156 100644 --- a/drivers/accel/ivpu/ivpu_fw_log.c +++ b/drivers/accel/ivpu/ivpu_fw_log.c @@ -43,6 +43,10 @@ static int fw_log_from_bo(struct ivpu_device *vdev, stru= ct ivpu_bo *bo, u32 *off ivpu_dbg(vdev, FW_BOOT, "Invalid header size 0x%x\n", log->header_size); return -EINVAL; } + if (log->size < log->header_size) { + ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size); + return -EINVAL; + } if ((char *)log + log->size > (char *)ivpu_bo_vaddr(bo) + ivpu_bo_size(bo= )) { ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size); return -EINVAL; --=20 2.53.0