The IPC and firmware tracing buffers live in memory shared with the NPU firmware, so every field the host reads from them is untrusted input. This series fixes two places where the host trusted such input and could end up dereferencing addresses outside the underlying BO.
Both patches are tagged for stable. Magdalena Schulfer (2): accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr accel/ivpu: Validate firmware log buffer metadata drivers/accel/ivpu/ivpu_fw_log.c | 76 +++++++++++++++++++------------- drivers/accel/ivpu/ivpu_gem.h | 14 ++++-- drivers/accel/ivpu/ivpu_ipc.c | 7 +-- 3 files changed, 60 insertions(+), 37 deletions(-) base-commit: 4d4be202165e832d74849b4a68e289a2a377039c -- 2.43.0
