From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D21643E4BE; Tue, 16 Jun 2026 16:25:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781627147; cv=none; b=YmHGZm0AeLwUOQee3EMw64UKGr7vSE4/QaZUgCiracJvLpdVChdvbuZGschtyu4prSgWJLK+2qU8XqGggzqk2VvaT4ErhA6VPC953kboc+FxTt2uFC8oDm2cMdqie7Q1bAmVdM4ZdE44XYtQDQhQ5nCOmWv10FwMuwSAZ/0jdM8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781627147; c=relaxed/simple; bh=gFmHiJtEsRiLGbztsvstXebFO3/vPqbFBwIzjg5EpiA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=px+3a18lwGZwr3tQhxO4pJZxHcoSTk9RyAnizzUz9har2HPrKO5Gk4UbZceowdUCnERc6G3rFyNUQgXTrO24dVNibAw2Jxt3B+bGuDLj+Ce4U6NiAI+L/xbhJ1OtmBxXHrLorajvpJlPDV50NXnJmUWlE0rWbLO5NvinddpIFyM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=InX3F6VH; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="InX3F6VH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9732C1F000E9; Tue, 16 Jun 2026 16:25:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781627146; bh=3bFrGQilEl2VDrKh1tHay4mSY4+6TuIwhdhMR8FCZHw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=InX3F6VHajr8uKgQqEclXLIklgsbAi5AT5u3EpmWm/4CChJ194VQJ/sAgZ+JrCMM3 AxjwlM4iY5YkoxGcAsJehKpNFmWraJ2CR38ttlEQ2xUMUdzKLb+h7ry8PNmbqmsFk3 EVoL+f3cT3+35nqww5sihO3jZavG6KQ/18J+W6yo= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Andrzej Kacprowski , Karol Wachowski Subject: [PATCH 6.12 126/261] accel/ivpu: Add buffer overflow check in MS get_info_ioctl Date: Tue, 16 Jun 2026 20:29:24 +0530 Message-ID: <20260616145050.923307629@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260616145044.869532709@linuxfoundation.org> References: <20260616145044.869532709@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andrzej Kacprowski commit fb176425837693f50c5c9fc8db6fbb04af22bd0a upstream. Add validation that the info size returned from the metric stream info query is not exceeded when checked against the allocated buffer size. If the firmware returns a size larger than the buffer, reject the operation with -EOVERFLOW instead of proceeding with an incorrect buffer copy. Fixes: cdfad4db7756 ("accel/ivpu: Add NPU profiling support") Cc: stable@vger.kernel.org # v6.18+ Signed-off-by: Andrzej Kacprowski Reviewed-by: Karol Wachowski Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260529120841.135852-1-andrzej.kacprowski@linux.intel.com Signed-off-by: Greg Kroah-Hartman --- drivers/accel/ivpu/ivpu_ms.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/accel/ivpu/ivpu_ms.c +++ b/drivers/accel/ivpu/ivpu_ms.c @@ -282,6 +282,13 @@ int ivpu_ms_get_info_ioctl(struct drm_de if (ret) goto unlock; + if (info_size > ivpu_bo_size(bo)) { + ivpu_warn_ratelimited(vdev, "MS info overflow: %#llx > %#zx\n", + info_size, ivpu_bo_size(bo)); + ret = -EOVERFLOW; + goto unlock; + } + if (args->buffer_size < info_size) { ret = -ENOSPC; goto unlock;