[PATCH] accel/ivpu: Reject firmware log with size smaller than header

[PATCH] accel/ivpu: Reject firmware log with size smaller than header

[Jhonraushan]

fw_log_from_bo() validates the tracing buffer header_size and that the
log fits within the BO, but never checks that log->size is at least
log->header_size. fw_log_print_buffer() then computes:

  u32 data_size = log->size - log->header_size;

which underflows to a near-U32_MAX value when firmware reports a log whose
size is smaller than its header. That huge data_size defeats the
log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu:
Add bounds checks for firmware log indices"), so fw_log_print_lines() reads
far past the small real data region of the BO. A size of 0 also makes
fw_log_from_bo() advance the offset by 0, causing the callers to loop
forever on the same header.

Reject logs whose size is smaller than the header (which also rejects
size == 0).

Fixes: d4e4257afa6e ("accel/ivpu: Add firmware tracing support")
Cc: stable@vger.kernel.org
Signed-off-by: Jhonraushan <raushan.jhon@gmail.com>
---
 drivers/accel/ivpu/ivpu_fw_log.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/accel/ivpu/ivpu_fw_log.c b/drivers/accel/ivpu/ivpu_fw_log.c
index 275baf844b56..716467aa3156 100644
--- a/drivers/accel/ivpu/ivpu_fw_log.c
+++ b/drivers/accel/ivpu/ivpu_fw_log.c
@@ -43,6 +43,10 @@ static int fw_log_from_bo(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *off
 		ivpu_dbg(vdev, FW_BOOT, "Invalid header size 0x%x\n", log->header_size);
 		return -EINVAL;
 	}
+	if (log->size < log->header_size) {
+		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
+		return -EINVAL;
+	}
 	if ((char *)log + log->size > (char *)ivpu_bo_vaddr(bo) + ivpu_bo_size(bo)) {
 		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
 		return -EINVAL;
-- 
2.53.0

Re: [PATCH] accel/ivpu: Reject firmware log with size smaller than header

[Wachowski, Karol]

On 15-Jul-26 9:42, Jhonraushan wrote:
> fw_log_from_bo() validates the tracing buffer header_size and that the
> log fits within the BO, but never checks that log->size is at least
> log->header_size. fw_log_print_buffer() then computes:
> 
>    u32 data_size = log->size - log->header_size;
> 
> which underflows to a near-U32_MAX value when firmware reports a log whose
> size is smaller than its header. That huge data_size defeats the
> log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ivpu:
> Add bounds checks for firmware log indices"), so fw_log_print_lines() reads
> far past the small real data region of the BO. A size of 0 also makes
> fw_log_from_bo() advance the offset by 0, causing the callers to loop
> forever on the same header.
> 
> Reject logs whose size is smaller than the header (which also rejects
> size == 0).
> 
> Fixes: d4e4257afa6e ("accel/ivpu: Add firmware tracing support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jhonraushan <raushan.jhon@gmail.com>
> ---
>   drivers/accel/ivpu/ivpu_fw_log.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/accel/ivpu/ivpu_fw_log.c b/drivers/accel/ivpu/ivpu_fw_log.c
> index 275baf844b56..716467aa3156 100644
> --- a/drivers/accel/ivpu/ivpu_fw_log.c
> +++ b/drivers/accel/ivpu/ivpu_fw_log.c
> @@ -43,6 +43,10 @@ static int fw_log_from_bo(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *off
>   		ivpu_dbg(vdev, FW_BOOT, "Invalid header size 0x%x\n", log->header_size);
>   		return -EINVAL;
>   	}
> +	if (log->size < log->header_size) {
> +		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
> +		return -EINVAL;
> +	}
>   	if ((char *)log + log->size > (char *)ivpu_bo_vaddr(bo) + ivpu_bo_size(bo)) {
>   		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
>   		return -EINVAL;

Thanks for submission.

Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>

Re: [PATCH] accel/ivpu: Reject firmware log with size smaller than header

[Wachowski, Karol]

On 15-Jul-26 10:21, Wachowski, Karol wrote:
> On 15-Jul-26 9:42, Jhonraushan wrote:
>> fw_log_from_bo() validates the tracing buffer header_size and that the
>> log fits within the BO, but never checks that log->size is at least
>> log->header_size. fw_log_print_buffer() then computes:
>>
>>    u32 data_size = log->size - log->header_size;
>>
>> which underflows to a near-U32_MAX value when firmware reports a log 
>> whose
>> size is smaller than its header. That huge data_size defeats the
>> log_start/log_end bounds clamps added by commit dd1311bcf0e6 ("accel/ 
>> ivpu:
>> Add bounds checks for firmware log indices"), so fw_log_print_lines() 
>> reads
>> far past the small real data region of the BO. A size of 0 also makes
>> fw_log_from_bo() advance the offset by 0, causing the callers to loop
>> forever on the same header.
>>
>> Reject logs whose size is smaller than the header (which also rejects
>> size == 0).
>>
>> Fixes: d4e4257afa6e ("accel/ivpu: Add firmware tracing support")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Jhonraushan <raushan.jhon@gmail.com>
>> ---
>>   drivers/accel/ivpu/ivpu_fw_log.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/accel/ivpu/ivpu_fw_log.c b/drivers/accel/ivpu/ 
>> ivpu_fw_log.c
>> index 275baf844b56..716467aa3156 100644
>> --- a/drivers/accel/ivpu/ivpu_fw_log.c
>> +++ b/drivers/accel/ivpu/ivpu_fw_log.c
>> @@ -43,6 +43,10 @@ static int fw_log_from_bo(struct ivpu_device *vdev, 
>> struct ivpu_bo *bo, u32 *off
>>           ivpu_dbg(vdev, FW_BOOT, "Invalid header size 0x%x\n", log- 
>> >header_size);
>>           return -EINVAL;
>>       }
>> +    if (log->size < log->header_size) {
>> +        ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
>> +        return -EINVAL;
>> +    }
>>       if ((char *)log + log->size > (char *)ivpu_bo_vaddr(bo) + 
>> ivpu_bo_size(bo)) {
>>           ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
>>           return -EINVAL;
> 
> Thanks for submission.
> 
> Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>

Applied to drm-misc-fixes.