* [PATCH v2] accel/ivpu: Fix signed integer truncation in IPC receive [not found] <b464b589-2d28-4617-baf0-eefbe14e170a@linux.intel.com> @ 2026-06-01 16:16 ` Andrzej Kacprowski 2026-06-08 7:27 ` Wachowski, Karol 0 siblings, 1 reply; 3+ messages in thread From: Andrzej Kacprowski @ 2026-06-01 16:16 UTC (permalink / raw) To: dri-devel Cc: oded.gabbay, jeff.hugo, lizhi.hou, karol.wachowski, dawid.osuchowski, david.laight.linux, Andrzej Kacprowski, stable Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned values (>= 0x80000000) become negative, causing unsigned wraparound and oversized memcpy operations that can overflow the stack buffer. Change min_t(int, ...) to min() as both values are unsigned and can be handled by min() without explicit cast. Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages") Cc: <stable@vger.kernel.org> # v6.12+ Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com> --- Changes in v2: - Replaced min_t() with min() drivers/accel/ivpu/ivpu_ipc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ivpu_ipc.c index f47df092bb0d..9347f05a2b79 100644 --- a/drivers/accel/ivpu/ivpu_ipc.c +++ b/drivers/accel/ivpu/ivpu_ipc.c @@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons, if (ipc_buf) memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf)); if (rx_msg->jsm_msg) { - u32 size = min_t(int, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg)); + u32 size = min(rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg)); if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) { ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg->jsm_msg->result); -- 2.43.0 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] accel/ivpu: Fix signed integer truncation in IPC receive 2026-06-01 16:16 ` [PATCH v2] accel/ivpu: Fix signed integer truncation in IPC receive Andrzej Kacprowski @ 2026-06-08 7:27 ` Wachowski, Karol 2026-06-09 5:54 ` Wachowski, Karol 0 siblings, 1 reply; 3+ messages in thread From: Wachowski, Karol @ 2026-06-08 7:27 UTC (permalink / raw) To: Andrzej Kacprowski, dri-devel Cc: oded.gabbay, jeff.hugo, lizhi.hou, dawid.osuchowski, david.laight.linux, stable On 01-Jun-26 18:16, Andrzej Kacprowski wrote: > Fix potential buffer overflow where firmware-supplied data_size is cast > to signed int before being used in min_t(). Large unsigned values > (>= 0x80000000) become negative, causing unsigned wraparound and > oversized memcpy operations that can overflow the stack buffer. > > Change min_t(int, ...) to min() as both values are unsigned and can be > handled by min() without explicit cast. > > Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages") > Cc: <stable@vger.kernel.org> # v6.12+ > Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com> > --- > Changes in v2: > - Replaced min_t() with min() Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com> > > drivers/accel/ivpu/ivpu_ipc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ivpu_ipc.c > index f47df092bb0d..9347f05a2b79 100644 > --- a/drivers/accel/ivpu/ivpu_ipc.c > +++ b/drivers/accel/ivpu/ivpu_ipc.c > @@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons, > if (ipc_buf) > memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf)); > if (rx_msg->jsm_msg) { > - u32 size = min_t(int, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg)); > + u32 size = min(rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg)); > > if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) { > ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg->jsm_msg->result); ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] accel/ivpu: Fix signed integer truncation in IPC receive 2026-06-08 7:27 ` Wachowski, Karol @ 2026-06-09 5:54 ` Wachowski, Karol 0 siblings, 0 replies; 3+ messages in thread From: Wachowski, Karol @ 2026-06-09 5:54 UTC (permalink / raw) To: Andrzej Kacprowski, dri-devel Cc: oded.gabbay, jeff.hugo, lizhi.hou, dawid.osuchowski, david.laight.linux, stable On 08-Jun-26 9:27, Wachowski, Karol wrote: > On 01-Jun-26 18:16, Andrzej Kacprowski wrote: >> Fix potential buffer overflow where firmware-supplied data_size is cast >> to signed int before being used in min_t(). Large unsigned values >> (>= 0x80000000) become negative, causing unsigned wraparound and >> oversized memcpy operations that can overflow the stack buffer. >> >> Change min_t(int, ...) to min() as both values are unsigned and can be >> handled by min() without explicit cast. >> >> Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done >> messages") >> Cc: <stable@vger.kernel.org> # v6.12+ >> Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com> >> --- >> Changes in v2: >> - Replaced min_t() with min() > > Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com> > >> >> drivers/accel/ivpu/ivpu_ipc.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ >> ivpu_ipc.c >> index f47df092bb0d..9347f05a2b79 100644 >> --- a/drivers/accel/ivpu/ivpu_ipc.c >> +++ b/drivers/accel/ivpu/ivpu_ipc.c >> @@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, >> struct ivpu_ipc_consumer *cons, >> if (ipc_buf) >> memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf)); >> if (rx_msg->jsm_msg) { >> - u32 size = min_t(int, rx_msg->ipc_hdr->data_size, >> sizeof(*jsm_msg)); >> + u32 size = min(rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg)); >> if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) { >> ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg- >> >jsm_msg->result); > Pushed to drm-misc-fixes. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-09 5:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <b464b589-2d28-4617-baf0-eefbe14e170a@linux.intel.com>
2026-06-01 16:16 ` [PATCH v2] accel/ivpu: Fix signed integer truncation in IPC receive Andrzej Kacprowski
2026-06-08 7:27 ` Wachowski, Karol
2026-06-09 5:54 ` Wachowski, Karol
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox