]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
gpu: nova-core: gsp: fix UB in DmaGspMem pointer accessors
authorDanilo Krummrich <dakr@kernel.org>
Mon, 9 Mar 2026 22:53:24 +0000 (23:53 +0100)
committerDanilo Krummrich <dakr@kernel.org>
Wed, 11 Mar 2026 15:24:15 +0000 (16:24 +0100)
commit0073a17b466684413ac87cf8ff6c19560db44e7a
tree6637abf4bac1505e62ebf0581e9558b768cdcdef
parentc7940c8bf215b9dc6211781c77ce80e76982a723
gpu: nova-core: gsp: fix UB in DmaGspMem pointer accessors

The DmaGspMem pointer accessor methods (gsp_write_ptr, gsp_read_ptr,
cpu_read_ptr, cpu_write_ptr, advance_cpu_read_ptr,
advance_cpu_write_ptr) dereference a raw pointer to DMA memory, creating
an intermediate reference before calling volatile read/write methods.

This is undefined behavior since DMA memory can be concurrently modified
by the device.

Fix this by moving the implementations into a gsp_mem module in fw.rs
that uses the dma_read!() / dma_write!() macros, making the original
methods on DmaGspMem thin forwarding wrappers.

An alternative approach would have been to wrap the shared memory in
Opaque, but that would have required even more unsafe code.

Since the gsp_mem module lives in fw.rs (to access firmware-specific
binding field names), GspMem, Msgq and their relevant fields are
temporarily widened to pub(super). This will be reverted once IoView
projections are available.

Cc: Gary Guo <gary@garyguo.net>
Closes: https://lore.kernel.org/nouveau/DGUT14ILG35P.1UMNRKU93JUM1@kernel.org/
Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling")
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260309225408.27714-1-dakr@kernel.org
[ Use pub(super) where possible; replace bitwise-and with modulo
  operator analogous to [1]. - Danilo ]
Link: https://lore.kernel.org/all/20260129-nova-core-cmdq1-v3-1-2ede85493a27@nvidia.com/
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
drivers/gpu/nova-core/gsp/cmdq.rs
drivers/gpu/nova-core/gsp/fw.rs