mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: "Rob Herring (Arm)" <robh@kernel.org>
To: Tomeu Vizoso <tomeu@tomeuvizoso.net>,
	Oded Gabbay <ogabbay@kernel.org>,  Frank Li <Frank.Li@nxp.com>,
	Thomas Zimmermann <tzimmermann@suse.de>
Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: [PATCH v4 21/31] accel: ethosu: Account for feature map element size
Date: Thu, 29 Oct 2026 08:36:08 -0500	[thread overview]
Message-ID: <20261029-ethosu-fixes-v4-21-4aa25e22578e@kernel.org> (raw)
In-Reply-To: <20261029-ethosu-fixes-v4-0-4aa25e22578e@kernel.org>

The feature map bounds calculation currently accounts for only one byte
of the final element. This can leave the tail of B16, B32, and B64
elements outside the validated buffer.

Use the feature map element size when calculating the final byte.

Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
Cc: stable@vger.kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
---
v2:
 - new patch
---
 drivers/accel/ethosu/ethosu_gem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethosu_gem.c
index 3333477bf2e5..bf1489734769 100644
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -436,7 +436,7 @@ static u64 feat_matrix_length(struct ethosu_device *edev,
 		return U64_MAX;
 	}
 
-	if (check_add_overflow(addr, 1ULL, &offset))
+	if (check_add_overflow(addr, (u64)element_size, &offset))
 		return U64_MAX;
 
 	info->region_size[fm->region] = max(info->region_size[fm->region], offset);

-- 
2.53.0


  parent reply	other threads:[~2026-10-29 13:36 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-29 13:35 [PATCH v4 00/31] accel: ethosu: Another batch of fixes Rob Herring (Arm)
2026-10-29 13:35 ` [PATCH v4 01/31] accel: ethosu: Suspend after initialization Rob Herring (Arm)
2026-10-29 15:42   ` Frank Li
2026-10-29 13:35 ` [PATCH v4 02/31] accel: ethosu: Ensure suspended on removal Rob Herring (Arm)
2026-10-29 13:35 ` [PATCH v4 03/31] accel: ethosu: Fix probe error cleanup Rob Herring (Arm)
2026-10-29 15:52   ` Frank Li
2026-10-29 16:00     ` Rob Herring
2026-10-29 16:20       ` Frank Li
2026-10-29 13:35 ` [PATCH v4 04/31] accel: ethosu: Disable clocks on PM setup failure Rob Herring (Arm)
2026-10-29 13:35 ` [PATCH v4 05/31] accel: ethosu: Quiesce jobs before scheduler teardown Rob Herring (Arm)
2026-10-29 13:35 ` [PATCH v4 06/31] accel: ethosu: Fix runtime PM get error handling Rob Herring (Arm)
2026-10-29 16:03   ` Frank Li
2026-10-29 16:38   ` Frank Li
2026-10-29 13:35 ` [PATCH v4 07/31] accel: ethosu: Limit perfmon counters to UAPI Rob Herring (Arm)
2026-10-29 13:35 ` [PATCH v4 08/31] accel: ethosu: Serialize job completion Rob Herring (Arm)
2026-10-29 13:35 ` [PATCH v4 09/31] accel: ethosu: Guard operations after unplug Rob Herring (Arm)
2026-10-29 13:35 ` [PATCH v4 10/31] accel: ethosu: Keep scheduler " Rob Herring (Arm)
2026-10-29 13:35 ` [PATCH v4 11/31] accel: ethosu: Clear SRAM before submission Rob Herring (Arm)
2026-10-29 13:35 ` [PATCH v4 12/31] accel: ethosu: Validate timeout command offset Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 13/31] accel: ethosu: Prevent command stream export Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 14/31] accel: ethosu: Move DMA mode to src/dst struct Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 15/31] accel: ethosu: Track command stream register setup Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 16/31] accel: ethosu: Factor buffer bounds checks Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 17/31] accel: ethosu: Fix NHCWB16 bounds calculation Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 18/31] accel: ethosu: Validate secondary streams Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 19/31] accel: ethosu: Reject unsupported commands and params Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 20/31] accel: ethosu: Validate all feature map tiles Rob Herring (Arm)
2026-10-29 13:36 ` Rob Herring (Arm) [this message]
2026-10-29 13:36 ` [PATCH v4 22/31] accel: ethosu: Validate convolution parameter Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 23/31] accel: ethosu: Account for kernel dilation in IFM size Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 24/31] accel: ethosu: Validate accumulator input Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 25/31] accel: ethosu: Restrict dynamic IFM2 weights Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 26/31] accel: ethosu: Split U65 and U85 DMA length validation Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 27/31] accel: ethosu: Validate OFM transpose Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 28/31] accel: ethosu: Validate resize operations Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 29/31] accel: ethosu: Ensure cmd stream is multiple of 4 bytes Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 30/31] accel: ethosu: Require active weight streams setup Rob Herring (Arm)
2026-10-29 13:36 ` [PATCH v4 31/31] accel: ethosu: Support U85 IFM upscaling Rob Herring (Arm)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261029-ethosu-fixes-v4-21-4aa25e22578e@kernel.org \
    --to=robh@kernel.org \
    --cc=Frank.Li@nxp.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=ogabbay@kernel.org \
    --cc=tomeu@tomeuvizoso.net \
    --cc=tzimmermann@suse.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®