accel/ethosu: fix arithmetic issues in dma_length()

dma_length() derives DMA region usage from command stream values and
updates region_size[]:

    len = ((len + stride[0]) * size0 + stride[1]) * size1
    region_size[region] = max(..., len + dma->offset)

Several arithmetic issues can corrupt the derived region size:

- signed stride values may underflow when added to len
- intermediate multiplications may overflow
- len + dma->offset may overflow during region_size updates
- dma_length() error returns were not validated by the caller

region_size[] is later used by ethosu_job.c to validate command stream
accesses against GEM buffer sizes. Arithmetic wraparound can therefore
under-report region usage and bypass the bounds validation.

Fix by validating signed additions, using overflow helpers for
multiplications and offset updates, and propagating dma_length()
failures to the caller.

Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Link: https://patch.msgid.link/20260524103710.47397-1-meatuni001@gmail.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>

diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethosu_gem.c
index 52b6a8752c750dcd1c1640255be45f30206f4701..27c5fdbe9a5d99c8a73dd7581b71f7af783330c6 100644 (file)
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -2,6 +2,7 @@
 /* Copyright 2025 Arm, Ltd. */
 
 #include <linux/err.h>
+#include <linux/overflow.h>
 #include <linux/slab.h>
 
 #include <drm/ethosu_accel.h>
@@ -164,16 +165,26 @@ static u64 dma_length(struct ethosu_validated_cmdstream_info *info,
        u64 len = dma->len;
 
        if (mode >= 1) {
+               if (dma->stride[0] < 0 && (u64)(-dma->stride[0]) > len)
+                       return U64_MAX;
                len += dma->stride[0];
-               len *= dma_st->size0;
+               if (check_mul_overflow(len, (u64)dma_st->size0, &len))
+                       return U64_MAX;
        }
        if (mode == 2) {
+               if (dma->stride[1] < 0 && (u64)(-dma->stride[1]) > len)
+                       return U64_MAX;
                len += dma->stride[1];
-               len *= dma_st->size1;
+               if (check_mul_overflow(len, (u64)dma_st->size1, &len))
+                       return U64_MAX;
+       }
+       if (dma->region >= 0) {
+               u64 end;
+
+               if (check_add_overflow(len, dma->offset, &end))
+                       return U64_MAX;
+               info->region_size[dma->region] = max(info->region_size[dma->region], end);
        }
-       if (dma->region >= 0)
-               info->region_size[dma->region] = max(info->region_size[dma->region],
-                                                    len + dma->offset);
 
        return len;
 }
@@ -395,6 +406,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(struct drm_device *ddev,
                case NPU_OP_DMA_START:
                        srclen = dma_length(info, &st.dma, &st.dma.src);
                        dstlen = dma_length(info, &st.dma, &st.dma.dst);
+                       if (srclen == U64_MAX || dstlen == U64_MAX)
+                               return -EINVAL;
 
                        if (st.dma.dst.region >= 0)
                                info->output_region[st.dma.dst.region] = true;