]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
accel/ivpu: Fix signed integer truncation in IPC receive
authorAndrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Mon, 1 Jun 2026 16:16:43 +0000 (18:16 +0200)
committerKarol Wachowski <karol.wachowski@linux.intel.com>
Tue, 9 Jun 2026 05:52:50 +0000 (07:52 +0200)
commitd9faef564438d1e4579c692c046603e7ada7bdf4
treecfc51a5750b5fd3d720a6f386358370246fe62dc
parent3f26bb732cc136ab20176697c92f32c9c84cb125
accel/ivpu: Fix signed integer truncation in IPC receive

Fix potential buffer overflow where firmware-supplied data_size is cast
to signed int before being used in min_t(). Large unsigned values
(>= 0x80000000) become negative, causing unsigned wraparound and
oversized memcpy operations that can overflow the stack buffer.

Change min_t(int, ...) to min() as both values are unsigned and can be
handled by min() without explicit cast.

Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages")
Cc: stable@vger.kernel.org # v6.12+
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20260601161643.229342-1-andrzej.kacprowski@linux.intel.com
drivers/accel/ivpu/ivpu_ipc.c