[PATCH v2 0/3] accel/ivpu: Harden parsing of firmware-shared buffers

[Dawid Osuchowski <dawid.osuchowski@linux.intel.com>]

The IPC and firmware tracing buffers live in memory shared with the NPU
firmware, so every field the host reads from them is untrusted input.
This series fixes places where the host trusted such input and could
end up dereferencing addresses outside the underlying BO.

All patches are tagged for stable.

Changes since v1:
 - Added a new patch ("accel/ivpu: Limit firmware log name prints to
   field size") after Sashiko pointed out that log->name was still being
   printed with an unbounded "%s" conversion. The field is fixed-size
   and expected to be NUL-terminated, but a firmware bug could drop the
   terminator; harden the host against that case.
 - No changes to the other two patches.

Dawid Osuchowski (1):
  accel/ivpu: Limit firmware log name prints to field size

Magdalena Schulfer (2):
  accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr
  accel/ivpu: Validate firmware log buffer metadata

 drivers/accel/ivpu/ivpu_fw_log.c | 87 +++++++++++++++++++-------------
 drivers/accel/ivpu/ivpu_gem.h    | 14 +++--
 drivers/accel/ivpu/ivpu_ipc.c    |  7 +--
 3 files changed, 67 insertions(+), 41 deletions(-)

-- 
2.43.0