Andrzej Kacprowski 45cb105b86 accel/ivpu: Fix signed integer truncation in IPC receive ...

commit d9faef5644 upstream.

Fix potential buffer overflow where firmware-supplied data_size is cast
to signed int before being used in min_t(). Large unsigned values
(>= 0x80000000) become negative, causing unsigned wraparound and
oversized memcpy operations that can overflow the stack buffer.

Change min_t(int, ...) to min() as both values are unsigned and can be
handled by min() without explicit cast.

Fixes: 3b434a3445 ("accel/ivpu: Use threaded IRQ to handle JOB done messages")
Cc: stable@vger.kernel.org # v6.12+
Signed-off-by: Andrzej Kacprowski <andrzej.kacprowski@linux.intel.com>
Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
Link: https://patch.msgid.link/20260601161643.229342-1-andrzej.kacprowski@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-06-19 13:44:02 +02:00

..

amdxdna

accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()

2026-06-19 13:44:02 +02:00

habanalabs

…

ivpu

accel/ivpu: Fix signed integer truncation in IPC receive

2026-06-19 13:44:02 +02:00

qaic

accel/qaic: Add overflow check to remap_pfn_range during mmap

2026-06-01 17:50:59 +02:00

rocket

accel/rocket: fix UAF via dangling GEM handle in create_bo

2026-06-09 12:28:24 +02:00

drm_accel.c

…

Kconfig

…

Makefile

…