[PATCH v3 19/22] accel: ethosu: Restrict dynamic IFM2 weights

[Rob Herring (Arm)]

The validator bounds dynamic IFM2 weights as a 1x1 weight matrix, but
did not enforce the corresponding kernel shape. A larger crafted kernel
could make the NPU access beyond the validated IFM2 feature map.

Reject dynamic-weight convolutions whose kernel is not 1x1.

Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
Cc: sta...@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Rob Herring (Arm) <r...@kernel.org>
---
v2:
 - new patch
---
 drivers/accel/ethosu/ethosu_gem.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/accel/ethosu/ethosu_gem.c 
b/drivers/accel/ethosu/ethosu_gem.c
index 632a2352491a..df26ccd50a96 100644
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -590,6 +590,9 @@ static int calc_sizes(struct drm_device *ddev,
                    !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_RIGHT) ||
                    !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_BOTTOM))
                        return -EINVAL;
+               /* Dynamic IFM2 weights are only supported for 1x1 
convolutions. */
+               if (ifm2 && (st->ifm.width || st->ifm.height[2]))
+                       return -EINVAL;
                u32 stride_y = ((st->ifm.stride_kernel >> 8) & 0x2) +
                        ((st->ifm.stride_kernel >> 1) & 0x1) + 1;
                u32 stride_x = ((st->ifm.stride_kernel >> 5) & 0x2) +

-- 
2.53.0