accel/ivpu: Add bounds check for firmware runtime memory

Validate that the firmware runtime memory specified in the image
header is properly aligned and sized to hold the firmware image.
This prevents errors during memory allocation and image transfer.

Fixes: 2007e210b6a1 ("accel/ivpu: Split FW runtime and global memory buffers")
Cc: stable@vger.kernel.org # v7.0+
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20260529120853.135876-1-andrzej.kacprowski@linux.intel.com

diff --git a/drivers/accel/ivpu/ivpu_fw.c b/drivers/accel/ivpu/ivpu_fw.c
index 107f8ad31050051980fa7ba7a61960779577cea9..33c50779c06b0dbd81e1395a955e062d5023ef3e 100644 (file)
--- a/drivers/accel/ivpu/ivpu_fw.c
+++ b/drivers/accel/ivpu/ivpu_fw.c
@@ -259,6 +259,22 @@ static int ivpu_fw_parse(struct ivpu_device *vdev)
                return -EINVAL;
        }
 
+       if (!PAGE_ALIGNED(runtime_addr)) {
+               ivpu_err(vdev, "Runtime address 0x%llx not page aligned\n", runtime_addr);
+               return -EINVAL;
+       }
+
+       if (!PAGE_ALIGNED(runtime_size)) {
+               ivpu_err(vdev, "Runtime size %llu not page aligned\n", runtime_size);
+               return -EINVAL;
+       }
+
+       if (runtime_size < image_size) {
+               ivpu_err(vdev, "Runtime size too small: %llu, image size: %llu\n",
+                        runtime_size, image_size);
+               return -EINVAL;
+       }
+
        if (!ivpu_is_within_range(image_load_addr, image_size, &vdev->hw->ranges.runtime)) {
                ivpu_err(vdev, "Invalid firmware load address: 0x%llx and size %llu\n",
                         image_load_addr, image_size);