Commit 9d250ab0 authored by Alexandre Courbot's avatar Alexandre Courbot
Browse files

gpu: nova-core: gsp: fix length of received messages 



The size of messages' payload is miscalculated, leading to extra data
passed to the message handler. While this is not a problem with our
current set of commands, others with a variable-length payload may
misbehave. Fix this by introducing a method returning the payload size
and using it.

Fixes: 75f6b1de ("gpu: nova-core: gsp: Add GSP command queue bindings and handling")
Reviewed-by: default avatarLyude Paul <lyude@redhat.com>
Reviewed-by: default avatarJoel Fernandes <joelagnelf@nvidia.com>
Reviewed-by: default avatarAlistair Popple <apopple@nvidia.com>
Acked-by: default avatarDanilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20251216-nova-fixes-v3-2-c7469a71f7c4@nvidia.com


[acourbot@nvidia.com: update `PANIC:` comments as pointed out by Joel.]
Signed-off-by: default avatarAlexandre Courbot <acourbot@nvidia.com>
parent b6c76518

drivers/gpu/nova-core/gsp/cmdq.rs

+8 −6
Original line number Diff line number Diff line
@@ -588,21 +588,23 @@ fn wait_for_msg(&self, timeout: Delta) -> Result<GspMessage<'_>> { 
            header.length(),

        );



        let payload_length = header.payload_length();



        // Check that the driver read area is large enough for the message.

        if slice_1.len() + slice_2.len() < header.length() {

        if slice_1.len() + slice_2.len() < payload_length {

            return Err(EIO);

        }



        // Cut the message slices down to the actual length of the message.

        let (slice_1, slice_2) = if slice_1.len() > header.length() {

            // PANIC: we checked above that `slice_1` is at least as long as `msg_header.length()`.

            (slice_1.split_at(header.length()).0, &slice_2[0..0])

        let (slice_1, slice_2) = if slice_1.len() > payload_length {

            // PANIC: we checked above that `slice_1` is at least as long as `payload_length`.

            (slice_1.split_at(payload_length).0, &slice_2[0..0])

        } else {

            (

                slice_1,

                // PANIC: we checked above that `slice_1.len() + slice_2.len()` is at least as

                // large as `msg_header.length()`.

                slice_2.split_at(header.length() - slice_1.len()).0,

                // large as `payload_length`.

                slice_2.split_at(payload_length - slice_1.len()).0,

            )

        };

drivers/gpu/nova-core/gsp/fw.rs

+9 −4
Original line number Diff line number Diff line
@@ -853,11 +853,16 @@ pub(crate) fn set_checksum(&mut self, checksum: u32) { 
        self.inner.checkSum = checksum;

    }



    /// Returns the total length of the message.

    /// Returns the length of the message's payload.

    pub(crate) fn payload_length(&self) -> usize {

        // `rpc.length` includes the length of the RPC message header.

        num::u32_as_usize(self.inner.rpc.length)

            .saturating_sub(size_of::<bindings::rpc_message_header_v>())

    }



    /// Returns the total length of the message, message and RPC headers included.

    pub(crate) fn length(&self) -> usize {

        // `rpc.length` includes the length of the GspRpcHeader but not the message header.

        size_of::<Self>() - size_of::<bindings::rpc_message_header_v>()

            + num::u32_as_usize(self.inner.rpc.length)

        size_of::<Self>() + self.payload_length()

    }



    // Returns the sequence number of the message.