9bfd50e6dc
Use AlmaLinux OS secure boot cert
Enable Btrfs support for all kernel variants
af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361}
hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
qla4xxx: bring back deprecated PCI ids
be2iscsi: bring back deprecated PCI ids
kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained
gve: update QPL page registration logic to honor max_registered_pages (backport from upstream)
gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream)
37 lines
1.8 KiB
Diff
37 lines
1.8 KiB
Diff
From 4788556d4dd9d717037e385de178974e9649231d Mon Sep 17 00:00:00 2001
|
|
From: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
|
|
Date: Mon, 1 Jun 2026 18:16:43 +0200
|
|
Subject: [PATCH] accel/ivpu: Fix signed integer truncation in IPC receive
|
|
|
|
commit d9faef564438d1e4579c692c046603e7ada7bdf4 upstream.
|
|
|
|
Fix potential buffer overflow where firmware-supplied data_size is cast
|
|
to signed int before being used in min_t(). Large unsigned values
|
|
(>= 0x80000000) become negative, causing unsigned wraparound and
|
|
oversized memcpy operations that can overflow the stack buffer.
|
|
|
|
Change min_t(int, ...) to min() as both values are unsigned and can be
|
|
handled by min() without explicit cast.
|
|
|
|
Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages")
|
|
Cc: stable@vger.kernel.org # v6.12+
|
|
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
|
|
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
|
|
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
|
|
Link: https://patch.msgid.link/20260601161643.229342-1-andrzej.kacprowski@linux.intel.com
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
|
|
diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ivpu_ipc.c
|
|
index 5f00809..7fea203 100644
|
|
--- a/drivers/accel/ivpu/ivpu_ipc.c
|
|
+++ b/drivers/accel/ivpu/ivpu_ipc.c
|
|
@@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,
|
|
if (ipc_buf)
|
|
memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf));
|
|
if (rx_msg->jsm_msg) {
|
|
- u32 size = min_t(int, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
|
|
+ u32 size = min(rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg));
|
|
|
|
if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) {
|
|
ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg->jsm_msg->result);
|