panthor ControlIface OOB

Vulnerability analysis

The Panthor GPU driver computes offsets into a shared memory section using stride values provided by the GPU firmware. These offset calculations used 32-bit arithmetic that could wrap around, producing a small value that passes the bounds check while the actual memory access lands outside the shared section. The bounds checks also validated against the size of the host-side wrapper structure rather than the firmware control interface structure being mapped, and the global control interface was used without first verifying the shared section was large enough to contain it. The fix switches to 64-bit arithmetic for offset computation to prevent overflow, validates against the actual firmware control interface structure sizes using subtraction-based checks that avoid underflow, and adds a missing size check for the global control interface before it is mapped. This vulnerability affects systems with a Panthor (ARM Mali CSF) GPU and requires local access to the GPU device; the firmware must provide unexpected stride values for the bug to manifest.