Re: [PATCH v3 2/5] gpu: nova-core: rename heap size field

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Framebuffer layout calculations use raw subtraction on hardware-provided values, leading to integer underflow if the hardware reports an insufficient framebuffer size.
--

--- Patch [2]: [PATCH v3 2/5] gpu: nova-core: rename heap size field ---
commit 11d9ee61e9c07ef3fa88364b2849b70d424c5735
Author: Eliot Courtney <ecourtney@nvidia.com>

gpu: nova-core: rename heap size field

This commit renames the heap field to non_wpr_heap in the nova-core driver's
framebuffer layout struct, unifying the naming convention.

> diff --git a/drivers/gpu/nova-core/fb.rs b/drivers/gpu/nova-core/fb.rs
> index 273cff752fae7..1f7b6a69e4db8 100644
> --- a/drivers/gpu/nova-core/fb.rs
> +++ b/drivers/gpu/nova-core/fb.rs
[ ... ]
> @@ -251,9 +251,9 @@ pub(crate) fn new(chipset: Chipset, bar: Bar0<'_>, gsp_fw: &GspFirmware) -> Resu
>              FbRange(wpr2_addr..frts.end)
>          };
>  
> -        let heap = {
> -            let heap_size = u64::from(hal.non_wpr_heap_size());
> -            FbRange(wpr2.start - heap_size..wpr2.start)
> +        let non_wpr_heap = {
> +            let non_wpr_heap_size = u64::from(hal.non_wpr_heap_size());
> +            FbRange(wpr2.start - non_wpr_heap_size..wpr2.start)

[Severity: High]
This isn't a bug introduced by this patch, but could this subtraction underflow
if the hardware reports a framebuffer size smaller than the required components?

The layout calculations in FbLayout::new() sequentially subtract required
firmware region sizes from the total hardware-provided vidmem_size. For example,
an earlier calculation does fb.end - NV_PRAMIN_SIZE, which would underflow if
the reported size is less than 1MB. Similarly, the subtraction
wpr2.start - non_wpr_heap_size here will underflow if the accumulated
allocations exceed the total vidmem_size.

Could this cause a panic in debug builds, or wrap to a very large offset in
release builds, leading to memory corruption or crashes when interacting with
untrusted or malfunctioning hardware?

>          };
>  
>          Ok(Self {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724-blackwell-fixes-v3-0-01aa6a54e3fd@nvidia.com?part=2