Speaker
Description
The Linux accel/ subsystem is still relatively young, yet it already exposes
complex userspace interfaces for machine learning accelerators. These drivers
process user-controlled command streams, DMA descriptors, tensors, and region
metadata, making input validation critical.
This talk presents the results of a security audit of the accel/ethosu driver
that led to seven upstream fixes merged in 2026, with the fixes subsequently
backported to supported stable kernel series where appropriate. The issues
included out-of-bounds accesses, arithmetic overflows, incorrect index
validation, sentinel misuse, and insufficient validation of DMA-related
metadata.
Rather than focusing on individual bug fixes, the presentation identifies the
recurring implementation patterns that produced these vulnerabilities and
discusses practical techniques for preventing similar issues in future
accelerator drivers. Topics include overflow-safe arithmetic, structured input
validation, region and descriptor verification, and opportunities for improving
fuzz testing of accelerator interfaces.
The session concludes with discussion of possible common validation helpers,
security review guidelines for new accelerator drivers, and ways to improve the
long-term robustness of the Linux accel/ subsystem as ML hardware becomes
increasingly common.