Re: [PATCH v2 0/3] accel/ivpu: Harden parsing of firmware-shared buffers

["Wachowski, Karol" <karol.wachowski@linux.intel.com>]

On 01-Sep-26 14:57, Dawid Osuchowski wrote:
> The IPC and firmware tracing buffers live in memory shared with the NPU
> firmware, so every field the host reads from them is untrusted input.
> This series fixes places where the host trusted such input and could
> end up dereferencing addresses outside the underlying BO.
> 
> All patches are tagged for stable.
> 
> Changes since v1:
>   - Added a new patch ("accel/ivpu: Limit firmware log name prints to
>     field size") after Sashiko pointed out that log->name was still being
>     printed with an unbounded "%s" conversion. The field is fixed-size
>     and expected to be NUL-terminated, but a firmware bug could drop the
>     terminator; harden the host against that case.
>   - No changes to the other two patches.
> 
> Dawid Osuchowski (1):
>    accel/ivpu: Limit firmware log name prints to field size
> 
> Magdalena Schulfer (2):
>    accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr
>    accel/ivpu: Validate firmware log buffer metadata
> 
>   drivers/accel/ivpu/ivpu_fw_log.c | 87 +++++++++++++++++++-------------
>   drivers/accel/ivpu/ivpu_gem.h    | 14 +++--
>   drivers/accel/ivpu/ivpu_ipc.c    |  7 +--
>   3 files changed, 67 insertions(+), 41 deletions(-)
> 

Thanks,
Applied to drm-misc-fixes.

Karol