On 01-Sep-26 14:57, Dawid Osuchowski wrote:
The IPC and firmware tracing buffers live in memory shared with the NPU firmware, so every field the host reads from them is untrusted input. This series fixes places where the host trusted such input and could end up dereferencing addresses outside the underlying BO.All patches are tagged for stable. Changes since v1: - Added a new patch ("accel/ivpu: Limit firmware log name prints to field size") after Sashiko pointed out that log->name was still being printed with an unbounded "%s" conversion. The field is fixed-size and expected to be NUL-terminated, but a firmware bug could drop the terminator; harden the host against that case. - No changes to the other two patches. Dawid Osuchowski (1): accel/ivpu: Limit firmware log name prints to field size Magdalena Schulfer (2): accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr accel/ivpu: Validate firmware log buffer metadata drivers/accel/ivpu/ivpu_fw_log.c | 87 +++++++++++++++++++------------- drivers/accel/ivpu/ivpu_gem.h | 14 +++-- drivers/accel/ivpu/ivpu_ipc.c | 7 +-- 3 files changed, 67 insertions(+), 41 deletions(-)
Thanks, Applied to drm-misc-fixes. Karol
