[PATCH v4 17/31] accel: ethosu: Fix NHCWB16 bounds calculation
From: Rob Herring (Arm)
Date: Thu Oct 29 2026 - 09:45:37 EST
The Ethos-U NPU inherently processes NHCWB16 data in 16-channel bricks.
The NHCWB16 address calculation uses the final channel of the last
accessed brick. If the channel depth modulo 16 is less than 15, the
hardware will still read or write the full 16-element brick.
Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
Reported-by: sashiko-bot@xxxxxxxxxx
Signed-off-by: Rob Herring (Arm) <robh@xxxxxxxxxx>
---
v3:
- new patch
---
drivers/accel/ethosu/ethosu_gem.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethosu_gem.c
index 24f88696c18b..67c7cbbd39b8 100644
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -415,9 +415,10 @@ static u64 feat_matrix_length(struct ethosu_device *edev,
case 1: //nhcwb16:
element_size = BIT((fm->precision >> (ofm ? 1 : 2)) & 0x3);
+ /* NHCWB16 accesses the complete final channel brick. */
if (check_mul_overflow(c / 16, (u64)fm->stride_c, &offset) ||
check_add_overflow(addr, offset, &addr) ||
- check_mul_overflow(16 * x + (c & 0xf), element_size, &offset) ||
+ check_mul_overflow(16 * x + 15, element_size, &offset) ||
check_add_overflow(addr, offset, &addr))
return U64_MAX;
break;
--
2.53.0