tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

gpu: nova-core: gsp: fix improper indexing in driver_read_area

The current code indexes into `after_rx` using `tx` which is an index
for the whole buffer, not the split buffer `after_rx`.

Also add more rigorous no-panic proofs.

Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling")
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260129-nova-core-cmdq1-v3-5-2ede85493a27@nvidia.com
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>

authored by

Eliot Courtney and committed by
Alexandre Courbot 5cdbed3a f64caf67

+12 -7
+12 -7
drivers/gpu/nova-core/gsp/cmdq.rs
··· 1 1 // SPDX-License-Identifier: GPL-2.0 2 2 3 3 use core::{ 4 - cmp, 5 4 mem, 6 5 sync::atomic::{ 7 6 fence, ··· 264 265 // - We will only access the driver-owned part of the shared memory. 265 266 // - Per the safety statement of the function, no concurrent access will be performed. 266 267 let gsp_mem = &unsafe { self.0.as_slice(0, 1) }.unwrap()[0]; 267 - // PANIC: per the invariant of `cpu_read_ptr`, `rx` is `< MSGQ_NUM_PAGES`. 268 - let (before_rx, after_rx) = gsp_mem.gspq.msgq.data.split_at(rx); 268 + let data = &gsp_mem.gspq.msgq.data; 269 269 270 - match tx.cmp(&rx) { 271 - cmp::Ordering::Equal => (&[], &[]), 272 - cmp::Ordering::Greater => (&after_rx[..tx], &[]), 273 - cmp::Ordering::Less => (after_rx, &before_rx[..tx]), 270 + // The area starting at `rx` and ending at `tx - 1` modulo MSGQ_NUM_PAGES, inclusive, 271 + // belongs to the driver for reading. 272 + // PANIC: 273 + // - per the invariant of `cpu_read_ptr`, `rx < MSGQ_NUM_PAGES` 274 + // - per the invariant of `gsp_write_ptr`, `tx < MSGQ_NUM_PAGES` 275 + if rx <= tx { 276 + // The area is contiguous. 277 + (&data[rx..tx], &[]) 278 + } else { 279 + // The area is discontiguous. 280 + (&data[rx..], &data[..tx]) 274 281 } 275 282 } 276 283