[PATCH] accel/ivpu: Add bounds check for firmware runtime memory

[PATCH] accel/ivpu: Add bounds check for firmware runtime memory

[Andrzej Kacprowski]

Validate that the firmware runtime memory specified in the image
header is properly aligned and sized to hold the firmware image.
This prevents errors during memory allocation and image transfer.

Fixes: 2007e210b6a1 ("accel/ivpu: Split FW runtime and global memory buffers")
Cc: <stable@vger.kernel.org> # v7.0+
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
---
 drivers/accel/ivpu/ivpu_fw.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/accel/ivpu/ivpu_fw.c b/drivers/accel/ivpu/ivpu_fw.c
index 107f8ad31050..33c50779c06b 100644
--- a/drivers/accel/ivpu/ivpu_fw.c
+++ b/drivers/accel/ivpu/ivpu_fw.c
@@ -259,6 +259,22 @@ static int ivpu_fw_parse(struct ivpu_device *vdev)
 		return -EINVAL;
 	}
 
+	if (!PAGE_ALIGNED(runtime_addr)) {
+		ivpu_err(vdev, "Runtime address 0x%llx not page aligned\n", runtime_addr);
+		return -EINVAL;
+	}
+
+	if (!PAGE_ALIGNED(runtime_size)) {
+		ivpu_err(vdev, "Runtime size %llu not page aligned\n", runtime_size);
+		return -EINVAL;
+	}
+
+	if (runtime_size < image_size) {
+		ivpu_err(vdev, "Runtime size too small: %llu, image size: %llu\n",
+			 runtime_size, image_size);
+		return -EINVAL;
+	}
+
 	if (!ivpu_is_within_range(image_load_addr, image_size, &vdev->hw->ranges.runtime)) {
 		ivpu_err(vdev, "Invalid firmware load address: 0x%llx and size %llu\n",
 			 image_load_addr, image_size);
-- 
2.43.0

Re: [PATCH] accel/ivpu: Add bounds check for firmware runtime memory

[Wachowski, Karol]

On 29-May-26 14:08, Andrzej Kacprowski wrote:
> Validate that the firmware runtime memory specified in the image
> header is properly aligned and sized to hold the firmware image.
> This prevents errors during memory allocation and image transfer.
> 
> Fixes: 2007e210b6a1 ("accel/ivpu: Split FW runtime and global memory buffers")
> Cc: <stable@vger.kernel.org> # v7.0+
> Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>

Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>

> ---
>   drivers/accel/ivpu/ivpu_fw.c | 16 ++++++++++++++++
>   1 file changed, 16 insertions(+)
> 
> diff --git a/drivers/accel/ivpu/ivpu_fw.c b/drivers/accel/ivpu/ivpu_fw.c
> index 107f8ad31050..33c50779c06b 100644
> --- a/drivers/accel/ivpu/ivpu_fw.c
> +++ b/drivers/accel/ivpu/ivpu_fw.c
> @@ -259,6 +259,22 @@ static int ivpu_fw_parse(struct ivpu_device *vdev)
>   		return -EINVAL;
>   	}
>   
> +	if (!PAGE_ALIGNED(runtime_addr)) {
> +		ivpu_err(vdev, "Runtime address 0x%llx not page aligned\n", runtime_addr);
> +		return -EINVAL;
> +	}
> +
> +	if (!PAGE_ALIGNED(runtime_size)) {
> +		ivpu_err(vdev, "Runtime size %llu not page aligned\n", runtime_size);
> +		return -EINVAL;
> +	}
> +
> +	if (runtime_size < image_size) {
> +		ivpu_err(vdev, "Runtime size too small: %llu, image size: %llu\n",
> +			 runtime_size, image_size);
> +		return -EINVAL;
> +	}
> +
>   	if (!ivpu_is_within_range(image_load_addr, image_size, &vdev->hw->ranges.runtime)) {
>   		ivpu_err(vdev, "Invalid firmware load address: 0x%llx and size %llu\n",
>   			 image_load_addr, image_size);