]> git.ipfire.org Git - thirdparty/linux.git/commit
accel/ivpu: Reject firmware log with size smaller than header
authorJhonraushan <raushan.jhon@gmail.com>
Wed, 15 Jul 2026 07:42:06 +0000 (13:12 +0530)
committerKarol Wachowski <karol.wachowski@linux.intel.com>
Wed, 15 Jul 2026 14:17:10 +0000 (16:17 +0200)
commitddb44baed257560f192b145ed36cf8c0a412de47
tree333695231578d28f29153b760e9535377c6641be
parent022e901333c3054656a640794e842bab7af5a75c
accel/ivpu: Reject firmware log with size smaller than header

fw_log_from_bo() validates the tracing buffer header_size and that the
log fits within the BO, but never checks that log->size is at least
log->header_size. fw_log_print_buffer() then computes:

  u32 data_size = log->size - log->header_size;

which underflows to a near-U32_MAX value when firmware reports a log whose
size is smaller than its header. That huge data_size defeats the
log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu:
Add bounds checks for firmware log indices"), so fw_log_print_lines() reads
far past the small real data region of the BO. A size of 0 also makes
fw_log_from_bo() advance the offset by 0, causing the callers to loop
forever on the same header.

Reject logs whose size is smaller than the header (which also rejects
size == 0).

Fixes: d4e4257afa6e ("accel/ivpu: Add firmware tracing support")
Cc: stable@vger.kernel.org
Signed-off-by: Jhonraushan <raushan.jhon@gmail.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20260715074206.867712-1-raushan.jhon@gmail.com
drivers/accel/ivpu/ivpu_fw_log.c