From: Joel Fernandes <joelagnelf@nvidia.com>
Date: Mon, 26 Jan 2026 20:23:03 +0000 (-0500)
Subject: gpu: nova-core: use checked arithmetic in frombytes_at helper
X-Git-Tag: v7.1-rc1~167^2~13^2~103
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=457c70b7dde5c14f940664fdc7f0e1998aff56be;p=thirdparty%2Flinux.git

gpu: nova-core: use checked arithmetic in frombytes_at helper

Use checked_add() when computing the end offset in the frombytes_at()
helper function. This function is called with firmware-provided offsets.

Reviewed-by: Zhi Wang <zhiw@nvidia.com>
Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260126202305.2526618-4-joelagnelf@nvidia.com
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
---

diff --git a/drivers/gpu/nova-core/firmware/booter.rs b/drivers/gpu/nova-core/firmware/booter.rs
index 21cd437a3c954..ab374026b1f49 100644
--- a/drivers/gpu/nova-core/firmware/booter.rs
+++ b/drivers/gpu/nova-core/firmware/booter.rs
@@ -43,8 +43,9 @@ use crate::{
 /// Local convenience function to return a copy of `S` by reinterpreting the bytes starting at
 /// `offset` in `slice`.
 fn frombytes_at<S: FromBytes + Sized>(slice: &[u8], offset: usize) -> Result<S> {
+    let end = offset.checked_add(size_of::<S>()).ok_or(EINVAL)?;
     slice
-        .get(offset..offset + size_of::<S>())
+        .get(offset..end)
         .and_then(S::from_bytes_copy)
         .ok_or(EINVAL)
 }