Commit ee6d9b6e5162 for kernel

commit ee6d9b6e51626f259c6f0e38d94f91be4fd14754
Author: Muhammad Bilal <meatuni001@gmail.com>
Date:   Sun May 24 10:37:10 2026 +0000

    accel/ethosu: fix arithmetic issues in dma_length()

    dma_length() derives DMA region usage from command stream values and
    updates region_size[]:

        len = ((len + stride[0]) * size0 + stride[1]) * size1
        region_size[region] = max(..., len + dma->offset)

    Several arithmetic issues can corrupt the derived region size:

    - signed stride values may underflow when added to len
    - intermediate multiplications may overflow
    - len + dma->offset may overflow during region_size updates
    - dma_length() error returns were not validated by the caller

    region_size[] is later used by ethosu_job.c to validate command stream
    accesses against GEM buffer sizes. Arithmetic wraparound can therefore
    under-report region usage and bypass the bounds validation.

    Fix by validating signed additions, using overflow helpers for
    multiplications and offset updates, and propagating dma_length()
    failures to the caller.

    Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
    Link: https://patch.msgid.link/20260524103710.47397-1-meatuni001@gmail.com
    Signed-off-by: Rob Herring (Arm) <robh@kernel.org>

diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethosu_gem.c
index 52b6a8752c75..27c5fdbe9a5d 100644
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -2,6 +2,7 @@
 /* Copyright 2025 Arm, Ltd. */

 #include <linux/err.h>
+#include <linux/overflow.h>
 #include <linux/slab.h>

 #include <drm/ethosu_accel.h>
@@ -164,16 +165,26 @@ static u64 dma_length(struct ethosu_validated_cmdstream_info *info,
 	u64 len = dma->len;

 	if (mode >= 1) {
+		if (dma->stride[0] < 0 && (u64)(-dma->stride[0]) > len)
+			return U64_MAX;
 		len += dma->stride[0];
-		len *= dma_st->size0;
+		if (check_mul_overflow(len, (u64)dma_st->size0, &len))
+			return U64_MAX;
 	}
 	if (mode == 2) {
+		if (dma->stride[1] < 0 && (u64)(-dma->stride[1]) > len)
+			return U64_MAX;
 		len += dma->stride[1];
-		len *= dma_st->size1;
+		if (check_mul_overflow(len, (u64)dma_st->size1, &len))
+			return U64_MAX;
+	}
+	if (dma->region >= 0) {
+		u64 end;
+
+		if (check_add_overflow(len, dma->offset, &end))
+			return U64_MAX;
+		info->region_size[dma->region] = max(info->region_size[dma->region], end);
 	}
-	if (dma->region >= 0)
-		info->region_size[dma->region] = max(info->region_size[dma->region],
-						     len + dma->offset);

 	return len;
 }
@@ -395,6 +406,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(struct drm_device *ddev,
 		case NPU_OP_DMA_START:
 			srclen = dma_length(info, &st.dma, &st.dma.src);
 			dstlen = dma_length(info, &st.dma, &st.dma.dst);
+			if (srclen == U64_MAX || dstlen == U64_MAX)
+				return -EINVAL;

 			if (st.dma.dst.region >= 0)
 				info->output_region[st.dma.dst.region] = true;