From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: accel/ivpu: Fix signed integer truncation in IPC receive Date: Thu, 04 Jun 2026 16:40:23 +1000 Message-ID: In-Reply-To: <20260529115453.132291-1-andrzej.kacprowski@linux.intel.com> References: <20260529115453.132291-1-andrzej.kacprowski@linux.intel.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 Overall Series Review Subject: accel/ivpu: Fix signed integer truncation in IPC receive Author: Andrzej Kacprowski Patches: 2 Reviewed: 2026-06-04T16:40:23.158315 --- This is a single-patch fix for a signed integer truncation bug in the Intel VPU (IVPU) accelerator driver's IPC receive path. The fix is correct, minimal, and clearly explained. The `data_size` field is a `u32` sourced from firmware, and using `min_t(int, ...)` to compare it against `sizeof(*jsm_msg)` (also unsigned) is a genuine bug: any firmware-supplied value with bit 31 set would be interpreted as negative when cast to `int`, causing `min_t` to select the negative (now-huge-unsigned) value instead of the `sizeof`, leading to a stack buffer overflow via the subsequent `memcpy` at line 291. The fix is straightforward and appropriate for stable backport. No concerns. **Verdict: Patch looks good. Recommend acceptance.** --- Generated by Claude Code Patch Reviewer