* [PATCH] accel/ivpu: Fix signed integer truncation in IPC receive
@ 2026-05-29 11:50 Andrzej Kacprowski
2026-05-29 12:49 ` David Laight
0 siblings, 1 reply; 6+ messages in thread
From: Andrzej Kacprowski @ 2026-05-29 11:50 UTC (permalink / raw)
To: andrzej.kacprowski; +Cc: stable
Fix potential buffer overflow where firmware-supplied data_size is cast
to signed int before being used in min_t(). Large unsigned values
(>= 0x80000000) become negative, causing unsigned wraparound and
oversized memcpy operations that can overflow the stack buffer.
Change min_t(int, ...) to min_t(u32, ...) to ensure large values are
properly clamped instead of becoming negative.
Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages")
Cc: <stable@vger.kernel.org> # v6.18+
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
---
drivers/accel/ivpu/ivpu_ipc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ivpu_ipc.c
index f47df092bb0d..9980a7898bed 100644
--- a/drivers/accel/ivpu/ivpu_ipc.c
+++ b/drivers/accel/ivpu/ivpu_ipc.c
@@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,
if (ipc_buf)
memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf));
if (rx_msg->jsm_msg) {
- u32 size = min_t(int, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
+ u32 size = min_t(u32, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) {
ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg->jsm_msg->result);
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] accel/ivpu: Fix signed integer truncation in IPC receive
2026-05-29 11:50 [PATCH] accel/ivpu: Fix signed integer truncation in IPC receive Andrzej Kacprowski
@ 2026-05-29 12:49 ` David Laight
2026-06-01 16:10 ` Andrzej Kacprowski
0 siblings, 1 reply; 6+ messages in thread
From: David Laight @ 2026-05-29 12:49 UTC (permalink / raw)
To: Andrzej Kacprowski; +Cc: stable
On Fri, 29 May 2026 13:50:05 +0200
Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com> wrote:
> Fix potential buffer overflow where firmware-supplied data_size is cast
> to signed int before being used in min_t(). Large unsigned values
> (>= 0x80000000) become negative, causing unsigned wraparound and
> oversized memcpy operations that can overflow the stack buffer.
>
> Change min_t(int, ...) to min_t(u32, ...) to ensure large values are
> properly clamped instead of becoming negative.
Just use min(), no need for the casts that min_t() adds.
This is another (slightly unusual) example of why min_t() is broken.
Even with min() doing strict type checks the correct fix would have been to
use (u32)sizeof(*jsm_msg) - and completely ignore what checkpatch says.
-- David
>
> Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages")
> Cc: <stable@vger.kernel.org> # v6.18+
> Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
> ---
> drivers/accel/ivpu/ivpu_ipc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ivpu_ipc.c
> index f47df092bb0d..9980a7898bed 100644
> --- a/drivers/accel/ivpu/ivpu_ipc.c
> +++ b/drivers/accel/ivpu/ivpu_ipc.c
> @@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,
> if (ipc_buf)
> memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf));
> if (rx_msg->jsm_msg) {
> - u32 size = min_t(int, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
> + u32 size = min_t(u32, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
>
> if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) {
> ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg->jsm_msg->result);
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] accel/ivpu: Fix signed integer truncation in IPC receive
2026-05-29 12:49 ` David Laight
@ 2026-06-01 16:10 ` Andrzej Kacprowski
2026-06-01 16:16 ` [PATCH v2] " Andrzej Kacprowski
0 siblings, 1 reply; 6+ messages in thread
From: Andrzej Kacprowski @ 2026-06-01 16:10 UTC (permalink / raw)
To: David Laight; +Cc: stable
On 29-May-26 2:49 PM, David Laight wrote:
> On Fri, 29 May 2026 13:50:05 +0200
> Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com> wrote:
>
>> Fix potential buffer overflow where firmware-supplied data_size is cast
>> to signed int before being used in min_t(). Large unsigned values
>> (>= 0x80000000) become negative, causing unsigned wraparound and
>> oversized memcpy operations that can overflow the stack buffer.
>>
>> Change min_t(int, ...) to min_t(u32, ...) to ensure large values are
>> properly clamped instead of becoming negative.
>
> Just use min(), no need for the casts that min_t() adds.
>
> This is another (slightly unusual) example of why min_t() is broken.
> Even with min() doing strict type checks the correct fix would have been to
> use (u32)sizeof(*jsm_msg) - and completely ignore what checkpatch says.
>
> -- David
>
Thanks for the review.
I will replace min_t() with min().
-- Andrzej
>>
>> Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages")
>> Cc: <stable@vger.kernel.org> # v6.18+
>> Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
>> ---
>> drivers/accel/ivpu/ivpu_ipc.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ivpu_ipc.c
>> index f47df092bb0d..9980a7898bed 100644
>> --- a/drivers/accel/ivpu/ivpu_ipc.c
>> +++ b/drivers/accel/ivpu/ivpu_ipc.c
>> @@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,
>> if (ipc_buf)
>> memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf));
>> if (rx_msg->jsm_msg) {
>> - u32 size = min_t(int, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
>> + u32 size = min_t(u32, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
>>
>> if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) {
>> ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg->jsm_msg->result);
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] accel/ivpu: Fix signed integer truncation in IPC receive
2026-06-01 16:10 ` Andrzej Kacprowski
@ 2026-06-01 16:16 ` Andrzej Kacprowski
2026-06-08 7:27 ` Wachowski, Karol
0 siblings, 1 reply; 6+ messages in thread
From: Andrzej Kacprowski @ 2026-06-01 16:16 UTC (permalink / raw)
To: dri-devel
Cc: oded.gabbay, jeff.hugo, lizhi.hou, karol.wachowski,
dawid.osuchowski, david.laight.linux, Andrzej Kacprowski, stable
Fix potential buffer overflow where firmware-supplied data_size is cast
to signed int before being used in min_t(). Large unsigned values
(>= 0x80000000) become negative, causing unsigned wraparound and
oversized memcpy operations that can overflow the stack buffer.
Change min_t(int, ...) to min() as both values are unsigned and can be
handled by min() without explicit cast.
Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages")
Cc: <stable@vger.kernel.org> # v6.12+
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
---
Changes in v2:
- Replaced min_t() with min()
drivers/accel/ivpu/ivpu_ipc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ivpu_ipc.c
index f47df092bb0d..9347f05a2b79 100644
--- a/drivers/accel/ivpu/ivpu_ipc.c
+++ b/drivers/accel/ivpu/ivpu_ipc.c
@@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,
if (ipc_buf)
memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf));
if (rx_msg->jsm_msg) {
- u32 size = min_t(int, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
+ u32 size = min(rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) {
ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg->jsm_msg->result);
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] accel/ivpu: Fix signed integer truncation in IPC receive
2026-06-01 16:16 ` [PATCH v2] " Andrzej Kacprowski
@ 2026-06-08 7:27 ` Wachowski, Karol
2026-06-09 5:54 ` Wachowski, Karol
0 siblings, 1 reply; 6+ messages in thread
From: Wachowski, Karol @ 2026-06-08 7:27 UTC (permalink / raw)
To: Andrzej Kacprowski, dri-devel
Cc: oded.gabbay, jeff.hugo, lizhi.hou, dawid.osuchowski,
david.laight.linux, stable
On 01-Jun-26 18:16, Andrzej Kacprowski wrote:
> Fix potential buffer overflow where firmware-supplied data_size is cast
> to signed int before being used in min_t(). Large unsigned values
> (>= 0x80000000) become negative, causing unsigned wraparound and
> oversized memcpy operations that can overflow the stack buffer.
>
> Change min_t(int, ...) to min() as both values are unsigned and can be
> handled by min() without explicit cast.
>
> Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages")
> Cc: <stable@vger.kernel.org> # v6.12+
> Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
> ---
> Changes in v2:
> - Replaced min_t() with min()
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
>
> drivers/accel/ivpu/ivpu_ipc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ivpu_ipc.c
> index f47df092bb0d..9347f05a2b79 100644
> --- a/drivers/accel/ivpu/ivpu_ipc.c
> +++ b/drivers/accel/ivpu/ivpu_ipc.c
> @@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,
> if (ipc_buf)
> memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf));
> if (rx_msg->jsm_msg) {
> - u32 size = min_t(int, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
> + u32 size = min(rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
>
> if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) {
> ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg->jsm_msg->result);
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] accel/ivpu: Fix signed integer truncation in IPC receive
2026-06-08 7:27 ` Wachowski, Karol
@ 2026-06-09 5:54 ` Wachowski, Karol
0 siblings, 0 replies; 6+ messages in thread
From: Wachowski, Karol @ 2026-06-09 5:54 UTC (permalink / raw)
To: Andrzej Kacprowski, dri-devel
Cc: oded.gabbay, jeff.hugo, lizhi.hou, dawid.osuchowski,
david.laight.linux, stable
On 08-Jun-26 9:27, Wachowski, Karol wrote:
> On 01-Jun-26 18:16, Andrzej Kacprowski wrote:
>> Fix potential buffer overflow where firmware-supplied data_size is cast
>> to signed int before being used in min_t(). Large unsigned values
>> (>= 0x80000000) become negative, causing unsigned wraparound and
>> oversized memcpy operations that can overflow the stack buffer.
>>
>> Change min_t(int, ...) to min() as both values are unsigned and can be
>> handled by min() without explicit cast.
>>
>> Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done
>> messages")
>> Cc: <stable@vger.kernel.org> # v6.12+
>> Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
>> ---
>> Changes in v2:
>> - Replaced min_t() with min()
>
> Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
>
>>
>> drivers/accel/ivpu/ivpu_ipc.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/
>> ivpu_ipc.c
>> index f47df092bb0d..9347f05a2b79 100644
>> --- a/drivers/accel/ivpu/ivpu_ipc.c
>> +++ b/drivers/accel/ivpu/ivpu_ipc.c
>> @@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev,
>> struct ivpu_ipc_consumer *cons,
>> if (ipc_buf)
>> memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf));
>> if (rx_msg->jsm_msg) {
>> - u32 size = min_t(int, rx_msg->ipc_hdr->data_size,
>> sizeof(*jsm_msg));
>> + u32 size = min(rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
>> if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) {
>> ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg-
>> >jsm_msg->result);
>
Pushed to drm-misc-fixes.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-06-09 5:54 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-29 11:50 [PATCH] accel/ivpu: Fix signed integer truncation in IPC receive Andrzej Kacprowski
2026-05-29 12:49 ` David Laight
2026-06-01 16:10 ` Andrzej Kacprowski
2026-06-01 16:16 ` [PATCH v2] " Andrzej Kacprowski
2026-06-08 7:27 ` Wachowski, Karol
2026-06-09 5:54 ` Wachowski, Karol
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).