[PATCH] accel: ethosu: Validate SRAM size on submit

[PATCH] accel: ethosu: Validate SRAM size on submit

[Rob Herring (Arm)]

Regions with a BO are checked against the BO size, but the SRAM
region is not. The SRAM region doesn't have a BO, but the command stream
region size should be checked against the SRAM size. The job's
"sram_size" isn't useful here because an evil userspace could lie about
the size.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
---
 drivers/accel/ethosu/ethosu_job.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethosu_job.c
index ec85f4156744..e7b07cdbcced 100644
--- a/drivers/accel/ethosu/ethosu_job.c
+++ b/drivers/accel/ethosu/ethosu_job.c
@@ -417,9 +417,21 @@ static int ethosu_ioctl_submit_job(struct drm_device *dev, struct drm_file *file
 		struct drm_gem_object *gem;
 
 		/* Can only omit a BO handle if the region is not used or used for SRAM */
-		if (!job->region_bo_handles[i] &&
-		    (!cmd_info->region_size[i] || (i == ETHOSU_SRAM_REGION && job->sram_size)))
-			continue;
+		if (!job->region_bo_handles[i]) {
+			if (!cmd_info->region_size[i])
+				continue;
+			if (i == ETHOSU_SRAM_REGION) {
+				if (cmd_info->region_size[i] <= edev->npu_info.sram_size)
+					continue;
+
+				dev_err(dev->dev,
+					"cmd stream region %d size greater than SRAM size (%llu > %u)\n",
+					i, cmd_info->region_size[i], 
+					edev->npu_info.sram_size);
+				ret = -EINVAL;
+				goto out_cleanup_job;
+			}
+		}
 
 		if (job->region_bo_handles[i] && !cmd_info->region_size[i]) {
 			dev_err(dev->dev,
-- 
2.53.0

Claude review: accel: ethosu: Validate SRAM size on submit

[Claude Code Review Bot]

Overall Series Review

Subject: accel: ethosu: Validate SRAM size on submit
Author: "Rob Herring (Arm)" <robh@kernel.org>
Patches: 1
Reviewed: 2026-05-16T11:22:18.689614

---

This is a single-patch security fix for the Arm Ethos-U NPU accelerator driver. The patch addresses a real input validation gap: the command stream's region size for the SRAM region was not being validated against the hardware's actual SRAM size. The old code only checked `job->sram_size` (a user-supplied value from the ioctl), which as the commit message correctly notes, a malicious userspace could lie about. The fix validates against `edev->npu_info.sram_size`, which is the kernel-authoritative value derived from the hardware's gen_pool.

The patch is well-motivated and correct in its approach. One minor nit exists.

**Verdict: Looks good, one minor observation.**

---
Generated by Claude Code Patch Reviewer

Claude review: accel: ethosu: Validate SRAM size on submit

[Claude Code Review Bot]

Patch Review

**Correctness:** The core logic change is sound. Before this patch, the SRAM region bypass in the loop at line ~417 checked:

```c
if (!job->region_bo_handles[i] &&
    (!cmd_info->region_size[i] || (i == ETHOSU_SRAM_REGION && job->sram_size)))
    continue;
```

This allowed any SRAM region through as long as userspace set `job->sram_size` to nonzero — but `job->sram_size` comes directly from the `struct drm_ethosu_job` ioctl argument and can be anything. The new code instead validates against `edev->npu_info.sram_size`, which is set from `gen_pool_size()` during driver probe (`ethosu_drv.c:284`), making it trustworthy.

**Edge case — no SRAM configured:** When the device has no SRAM pool, `edev->npu_info.sram_size` is initialized to 0 (`ethosu_drv.c:278`). The new condition `cmd_info->region_size[i] <= edev->npu_info.sram_size` will only pass when `region_size[i]` is also 0, which was already handled by the `!cmd_info->region_size[i]` check above. So a nonzero SRAM region request on a device without SRAM will correctly be rejected. Good.

**Interaction with the earlier `job->sram_size` checks:** The existing validation at lines 377-381 still checks `job->sram_size` against `edev->npu_info.sram_size` and uses `job->sram_size` to guard HW register writes at line 60. Those uses remain valid — `job->sram_size` is bounded by the check at line 380, and is used to decide whether to program the SRAM base address, not to set a size limit. The new check is complementary, validating the *command stream's* declared region size, which is a separate trust boundary.

**Minor nit — trailing whitespace:** Line 428 in the patched file (`edev->npu_info.sram_size);`) appears to have a trailing space after the comma on the line above:

```c
				i, cmd_info->region_size[i], 
				edev->npu_info.sram_size);
```

There's a trailing space after the `,` before the newline continuation. This would likely trigger `checkpatch.pl --strict` warnings. Not a functional issue.

**Format specifier correctness:** `region_size[i]` is `u64` (from `ethosu_gem.h:12`), printed with `%llu` — correct. `sram_size` is `__u32` (from `ethosu_accel.h:81`), printed with `%u` — correct.

**Overall:** This is a clean, well-scoped security fix. The commit message accurately describes the problem and the approach. Reviewed-by worthy with or without the whitespace nit fix.

---
Generated by Claude Code Patch Reviewer