Re: [PATCH v2] accel/ivpu: Fix signed integer truncation in IPC receive

["Wachowski, Karol" <karol.wachowski@linux.intel.com>]

On 08-Jun-26 9:27, Wachowski, Karol wrote:
> On 01-Jun-26 18:16, Andrzej Kacprowski wrote:
>> Fix potential buffer overflow where firmware-supplied data_size is cast
>> to signed int before being used in min_t(). Large unsigned values
>> (>= 0x80000000) become negative, causing unsigned wraparound and
>> oversized memcpy operations that can overflow the stack buffer.
>>
>> Change min_t(int, ...) to min() as both values are unsigned and can be
>> handled by min() without explicit cast.
>>
>> Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done 
>> messages")
>> Cc: <stable@vger.kernel.org> # v6.12+
>> Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
>> ---
>> Changes in v2:
>> - Replaced min_t() with min()
> 
> Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
> 
>>
>>   drivers/accel/ivpu/ivpu_ipc.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ 
>> ivpu_ipc.c
>> index f47df092bb0d..9347f05a2b79 100644
>> --- a/drivers/accel/ivpu/ivpu_ipc.c
>> +++ b/drivers/accel/ivpu/ivpu_ipc.c
>> @@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, 
>> struct ivpu_ipc_consumer *cons,
>>       if (ipc_buf)
>>           memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf));
>>       if (rx_msg->jsm_msg) {
>> -        u32 size = min_t(int, rx_msg->ipc_hdr->data_size, 
>> sizeof(*jsm_msg));
>> +        u32 size = min(rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
>>           if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) {
>>               ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg- 
>> >jsm_msg->result);
> 

Pushed to drm-misc-fixes.