* [PATCH] accel/ivpu: Add bounds check for firmware runtime memory
@ 2026-05-29 12:08 Andrzej Kacprowski
2026-05-29 12:27 ` Wachowski, Karol
0 siblings, 1 reply; 3+ messages in thread
From: Andrzej Kacprowski @ 2026-05-29 12:08 UTC (permalink / raw)
To: dri-devel
Cc: oded.gabbay, jeff.hugo, lizhi.hou, karol.wachowski,
dawid.osuchowski, Andrzej Kacprowski, stable
Validate that the firmware runtime memory specified in the image
header is properly aligned and sized to hold the firmware image.
This prevents errors during memory allocation and image transfer.
Fixes: 2007e210b6a1 ("accel/ivpu: Split FW runtime and global memory buffers")
Cc: <stable@vger.kernel.org> # v7.0+
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
---
drivers/accel/ivpu/ivpu_fw.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/accel/ivpu/ivpu_fw.c b/drivers/accel/ivpu/ivpu_fw.c
index 107f8ad31050..33c50779c06b 100644
--- a/drivers/accel/ivpu/ivpu_fw.c
+++ b/drivers/accel/ivpu/ivpu_fw.c
@@ -259,6 +259,22 @@ static int ivpu_fw_parse(struct ivpu_device *vdev)
return -EINVAL;
}
+ if (!PAGE_ALIGNED(runtime_addr)) {
+ ivpu_err(vdev, "Runtime address 0x%llx not page aligned\n", runtime_addr);
+ return -EINVAL;
+ }
+
+ if (!PAGE_ALIGNED(runtime_size)) {
+ ivpu_err(vdev, "Runtime size %llu not page aligned\n", runtime_size);
+ return -EINVAL;
+ }
+
+ if (runtime_size < image_size) {
+ ivpu_err(vdev, "Runtime size too small: %llu, image size: %llu\n",
+ runtime_size, image_size);
+ return -EINVAL;
+ }
+
if (!ivpu_is_within_range(image_load_addr, image_size, &vdev->hw->ranges.runtime)) {
ivpu_err(vdev, "Invalid firmware load address: 0x%llx and size %llu\n",
image_load_addr, image_size);
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] accel/ivpu: Add bounds check for firmware runtime memory
2026-05-29 12:08 [PATCH] accel/ivpu: Add bounds check for firmware runtime memory Andrzej Kacprowski
@ 2026-05-29 12:27 ` Wachowski, Karol
2026-06-02 5:50 ` Wachowski, Karol
0 siblings, 1 reply; 3+ messages in thread
From: Wachowski, Karol @ 2026-05-29 12:27 UTC (permalink / raw)
To: Andrzej Kacprowski, dri-devel
Cc: oded.gabbay, jeff.hugo, lizhi.hou, dawid.osuchowski, stable
On 29-May-26 14:08, Andrzej Kacprowski wrote:
> Validate that the firmware runtime memory specified in the image
> header is properly aligned and sized to hold the firmware image.
> This prevents errors during memory allocation and image transfer.
>
> Fixes: 2007e210b6a1 ("accel/ivpu: Split FW runtime and global memory buffers")
> Cc: <stable@vger.kernel.org> # v7.0+
> Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
> ---
> drivers/accel/ivpu/ivpu_fw.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/drivers/accel/ivpu/ivpu_fw.c b/drivers/accel/ivpu/ivpu_fw.c
> index 107f8ad31050..33c50779c06b 100644
> --- a/drivers/accel/ivpu/ivpu_fw.c
> +++ b/drivers/accel/ivpu/ivpu_fw.c
> @@ -259,6 +259,22 @@ static int ivpu_fw_parse(struct ivpu_device *vdev)
> return -EINVAL;
> }
>
> + if (!PAGE_ALIGNED(runtime_addr)) {
> + ivpu_err(vdev, "Runtime address 0x%llx not page aligned\n", runtime_addr);
> + return -EINVAL;
> + }
> +
> + if (!PAGE_ALIGNED(runtime_size)) {
> + ivpu_err(vdev, "Runtime size %llu not page aligned\n", runtime_size);
> + return -EINVAL;
> + }
> +
> + if (runtime_size < image_size) {
> + ivpu_err(vdev, "Runtime size too small: %llu, image size: %llu\n",
> + runtime_size, image_size);
> + return -EINVAL;
> + }
> +
> if (!ivpu_is_within_range(image_load_addr, image_size, &vdev->hw->ranges.runtime)) {
> ivpu_err(vdev, "Invalid firmware load address: 0x%llx and size %llu\n",
> image_load_addr, image_size);
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] accel/ivpu: Add bounds check for firmware runtime memory
2026-05-29 12:27 ` Wachowski, Karol
@ 2026-06-02 5:50 ` Wachowski, Karol
0 siblings, 0 replies; 3+ messages in thread
From: Wachowski, Karol @ 2026-06-02 5:50 UTC (permalink / raw)
To: Andrzej Kacprowski, dri-devel
Cc: oded.gabbay, jeff.hugo, lizhi.hou, dawid.osuchowski, stable
On 29-May-26 14:27, Wachowski, Karol wrote:
> On 29-May-26 14:08, Andrzej Kacprowski wrote:
>> Validate that the firmware runtime memory specified in the image
>> header is properly aligned and sized to hold the firmware image.
>> This prevents errors during memory allocation and image transfer.
>>
>> Fixes: 2007e210b6a1 ("accel/ivpu: Split FW runtime and global memory
>> buffers")
>> Cc: <stable@vger.kernel.org> # v7.0+
>> Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
>
> Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
>
Applied to drm-misc-fixes.
>> ---
>> drivers/accel/ivpu/ivpu_fw.c | 16 ++++++++++++++++
>> 1 file changed, 16 insertions(+)
>>
>> diff --git a/drivers/accel/ivpu/ivpu_fw.c b/drivers/accel/ivpu/ivpu_fw.c
>> index 107f8ad31050..33c50779c06b 100644
>> --- a/drivers/accel/ivpu/ivpu_fw.c
>> +++ b/drivers/accel/ivpu/ivpu_fw.c
>> @@ -259,6 +259,22 @@ static int ivpu_fw_parse(struct ivpu_device *vdev)
>> return -EINVAL;
>> }
>> + if (!PAGE_ALIGNED(runtime_addr)) {
>> + ivpu_err(vdev, "Runtime address 0x%llx not page aligned\n",
>> runtime_addr);
>> + return -EINVAL;
>> + }
>> +
>> + if (!PAGE_ALIGNED(runtime_size)) {
>> + ivpu_err(vdev, "Runtime size %llu not page aligned\n",
>> runtime_size);
>> + return -EINVAL;
>> + }
>> +
>> + if (runtime_size < image_size) {
>> + ivpu_err(vdev, "Runtime size too small: %llu, image size:
>> %llu\n",
>> + runtime_size, image_size);
>> + return -EINVAL;
>> + }
>> +
>> if (!ivpu_is_within_range(image_load_addr, image_size, &vdev-
>> >hw->ranges.runtime)) {
>> ivpu_err(vdev, "Invalid firmware load address: 0x%llx and
>> size %llu\n",
>> image_load_addr, image_size);
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-02 5:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-29 12:08 [PATCH] accel/ivpu: Add bounds check for firmware runtime memory Andrzej Kacprowski
2026-05-29 12:27 ` Wachowski, Karol
2026-06-02 5:50 ` Wachowski, Karol
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.