Re: [PATCH 1/2] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write

On Wed, Jul 01, 2026 at 09:26:32AM +0000, Daisuke Matsuda wrote:
> From: Daisuke Matsuda <[email protected]>
> 
> The trailing byte path in altera_cvp_send_block() dereferences a u32
> pointer even when only 1-3 bytes remain in the input buffer. If the buffer
> ends at a page or scatterlist boundary, this can read past the valid image
> data and fault.
> 
> Copy the remaining bytes into a zero-initialized u32 before writing the
> final word so only valid bytes are read from the input buffer.
> 
> Fixes: 34d1dc17ce97 ("fpga manager: Add Altera CvP driver")
> Signed-off-by: Daisuke Matsuda <[email protected]>
> ---
>  drivers/fpga/altera-cvp.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
> index 44badfd11e1b..c00292370a8e 100644
> --- a/drivers/fpga/altera-cvp.c
> +++ b/drivers/fpga/altera-cvp.c
> @@ -16,6 +16,7 @@
>  #include <linux/module.h>
>  #include <linux/pci.h>
>  #include <linux/sizes.h>
> +#include <linux/string.h>
>  
>  #define CVP_BAR		0	/* BAR used for data transfer in memory mode */
>  #define CVP_DUMMY_WR	244	/* dummy writes to clear CvP state machine */
> @@ -261,7 +262,7 @@ static int altera_cvp_v2_wait_for_credit(struct fpga_manager *mgr,
>  static int altera_cvp_send_block(struct altera_cvp_conf *conf,
>  				 const u32 *data, size_t len)
>  {
> -	u32 mask, words = len / sizeof(u32);
> +	u32 word, words = len / sizeof(u32);
>  	int i, remainder;
>  
>  	for (i = 0; i < words; i++)
> @@ -270,9 +271,9 @@ static int altera_cvp_send_block(struct altera_cvp_conf *conf,
>  	/* write up to 3 trailing bytes, if any */
>  	remainder = len % sizeof(u32);
>  	if (remainder) {

move the u32 word; declaration here, others look good to me.

> -		mask = BIT(remainder * 8) - 1;
> -		if (mask)
> -			conf->write_data(conf, *data & mask);
> +		word = 0;
> +		memcpy(&word, data, remainder);
> +		conf->write_data(conf, word);
>  	}
>  
>  	return 0;
> -- 
> 2.47.3
> 
>