The IPC and firmware tracing buffers live in memory shared with the NPU
firmware, so every field the host reads from them is untrusted input.
This series fixes places where the host trusted such input and could
end up dereferencing addresses outside the underlying BO.
All patches are tagged for stable.
Changes since v1:
- Added a new patch ("accel/ivpu: Limit firmware log name prints to
field size") after Sashiko pointed out that log->name was still being
printed with an unbounded "%s" conversion. The field is fixed-size
and expected to be NUL-terminated, but a firmware bug could drop the
terminator; harden the host against that case.
- No changes to the other two patches.
Dawid Osuchowski (1):
accel/ivpu: Limit firmware log name prints to field size
Magdalena Schulfer (2):
accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr
accel/ivpu: Validate firmware log buffer metadata
drivers/accel/ivpu/ivpu_fw_log.c | 87 +++++++++++++++++++-------------
drivers/accel/ivpu/ivpu_gem.h | 14 +++--
drivers/accel/ivpu/ivpu_ipc.c | 7 +--
3 files changed, 67 insertions(+), 41 deletions(-)
--
2.43.0
