Re: [PATCH v3 3/5] gpu: nova-core: return non-WPR heap size as u64 from HALs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The driver lacks bounds checking for framebuffer size and VGA workspace addresses read from untrusted device MMIO, leading to integer underflows and kernel panics.
--

--- Patch [3]: [PATCH v3 3/5] gpu: nova-core: return non-WPR heap size as u64 from HALs ---
commit 607f14f3038014abfcbe45e7fcb56d2a70d0bac2
Author: Eliot Courtney <ecourtney@nvidia.com>

gpu: nova-core: return non-WPR heap size as u64 from HALs

This commit changes the non_wpr_heap_size() HAL function to return a u64
directly, avoiding the need for a conversion when calculating the heap size.
It updates the HAL implementations for various chipsets accordingly.

> diff --git a/drivers/gpu/nova-core/fb.rs b/drivers/gpu/nova-core/fb.rs
> index 1f7b6a69e4db8..f5832e59de599 100644
> --- a/drivers/gpu/nova-core/fb.rs
> +++ b/drivers/gpu/nova-core/fb.rs
> @@ -252,7 +252,7 @@ pub(crate) fn new(chipset: Chipset, bar: Bar0<'_>, gsp_fw: &GspFirmware) -> Resu
>          };
>  
>          let non_wpr_heap = {
> -            let non_wpr_heap_size = u64::from(hal.non_wpr_heap_size());
> +            let non_wpr_heap_size = hal.non_wpr_heap_size();
>              FbRange(wpr2.start - non_wpr_heap_size..wpr2.start)

[Severity: High]
This is a pre-existing issue, but since we are modifying size calculations
here in FbLayout::new(), could a malicious device cause an integer underflow
earlier in this function?

If a device returns a framebuffer size smaller than NV_PRAMIN_SIZE (1MB) from
MMIO, the subtraction fb.end - NV_PRAMIN_SIZE will underflow and panic.

Additionally, the untrusted VGA workspace address read from MMIO isn't bounded
against fb.end. If the VGA workspace address is larger than the framebuffer
size, it can result in a range where start > end. When FbRange::len() is
called on this range, it will unconditionally subtract start from end, causing
another underflow panic.

Could we add upper bounds checking for the framebuffer size and VGA workspace
address against MMIO registers to prevent these crashes?

>          };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724-blackwell-fixes-v3-0-01aa6a54e3fd@nvidia.com?part=3