Re: [PATCH] accel/ivpu: Add bounds check for firmware runtime memory

["Wachowski, Karol" <karol.wachowski@linux.intel.com>]

On 29-May-26 14:27, Wachowski, Karol wrote:
> On 29-May-26 14:08, Andrzej Kacprowski wrote:
>> Validate that the firmware runtime memory specified in the image
>> header is properly aligned and sized to hold the firmware image.
>> This prevents errors during memory allocation and image transfer.
>>
>> Fixes: 2007e210b6a1 ("accel/ivpu: Split FW runtime and global memory 
>> buffers")
>> Cc: <stable@vger.kernel.org> # v7.0+
>> Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
> 
> Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
> 

Applied to drm-misc-fixes.

>> ---
>>   drivers/accel/ivpu/ivpu_fw.c | 16 ++++++++++++++++
>>   1 file changed, 16 insertions(+)
>>
>> diff --git a/drivers/accel/ivpu/ivpu_fw.c b/drivers/accel/ivpu/ivpu_fw.c
>> index 107f8ad31050..33c50779c06b 100644
>> --- a/drivers/accel/ivpu/ivpu_fw.c
>> +++ b/drivers/accel/ivpu/ivpu_fw.c
>> @@ -259,6 +259,22 @@ static int ivpu_fw_parse(struct ivpu_device *vdev)
>>           return -EINVAL;
>>       }
>> +    if (!PAGE_ALIGNED(runtime_addr)) {
>> +        ivpu_err(vdev, "Runtime address 0x%llx not page aligned\n", 
>> runtime_addr);
>> +        return -EINVAL;
>> +    }
>> +
>> +    if (!PAGE_ALIGNED(runtime_size)) {
>> +        ivpu_err(vdev, "Runtime size %llu not page aligned\n", 
>> runtime_size);
>> +        return -EINVAL;
>> +    }
>> +
>> +    if (runtime_size < image_size) {
>> +        ivpu_err(vdev, "Runtime size too small: %llu, image size: 
>> %llu\n",
>> +             runtime_size, image_size);
>> +        return -EINVAL;
>> +    }
>> +
>>       if (!ivpu_is_within_range(image_load_addr, image_size, &vdev- 
>> >hw->ranges.runtime)) {
>>           ivpu_err(vdev, "Invalid firmware load address: 0x%llx and 
>> size %llu\n",
>>                image_load_addr, image_size);
> 
>