+++ /dev/null
-From 16df3873c80388a71c4695909a51be0c809b889c Mon Sep 17 00:00:00 2001
-From: Eliot Courtney <ecourtney@nvidia.com>
-Date: Thu, 23 Apr 2026 16:11:44 +0900
-Subject: gpu: nova-core: simplify and_then with condition to filter
-
-From: Eliot Courtney <ecourtney@nvidia.com>
-
-commit 16df3873c80388a71c4695909a51be0c809b889c upstream.
-
-This code is more simply expressed using Option::filter instead of the
-and_then with conditional.
-
-This fixes the following warning with latest nightly Rust clippy build:
-
-warning: manual implementation of `Option::filter`
- --> drivers/gpu/nova-core/firmware.rs:391:14
- |
-391 | .and_then(|hdr| {
- | ______________^
-392 | | if hdr.bin_magic == BIN_MAGIC {
-393 | | Some(hdr)
-394 | | } else {
-... |
-397 | | })
- | |______________^ help: try: `filter(|hdr| hdr.bin_magic == BIN_MAGIC)`
- |
- = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#manual_filter
- = note: `-D clippy::manual-filter` implied by `-D warnings`
- = help: to override `-D warnings` add `#[allow(clippy::manual_filter)]`
-
-Cc: stable@vger.kernel.org
-Fixes: d6cb7319e64e ("gpu: nova-core: firmware: add support for common firmware header")
-Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
-Acked-by: Danilo Krummrich <dakr@kernel.org>
-Reviewed-by: Alice Ryhl <aliceryhl@google.com>
-Reviewed-by: Gary Guo <gary@garyguo.net>
-Link: https://patch.msgid.link/20260423-fix-filter-v1-1-b3b197c65daf@nvidia.com
-[aliceryhl: add Fixes: tag and quote the warning it fixes]
-Signed-off-by: Alice Ryhl <aliceryhl@google.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/gpu/nova-core/firmware.rs | 8 +-------
- 1 file changed, 1 insertion(+), 7 deletions(-)
-
---- a/drivers/gpu/nova-core/firmware.rs
-+++ b/drivers/gpu/nova-core/firmware.rs
-@@ -388,13 +388,7 @@ impl<'a> BinFirmware<'a> {
- // Extract header.
- .and_then(BinHdr::from_bytes_copy)
- // Validate header.
-- .and_then(|hdr| {
-- if hdr.bin_magic == BIN_MAGIC {
-- Some(hdr)
-- } else {
-- None
-- }
-- })
-+ .filter(|hdr| hdr.bin_magic == BIN_MAGIC)
- .map(|hdr| Self { hdr, fw })
- .ok_or(EINVAL)
- }
+++ /dev/null
-From f08ff82e444310bca694da7a6d4b3ddf4c8488b1 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 17 Apr 2026 14:13:54 -0500
-Subject: gpu: nova-core: use correct fwsignature for GA100
-
-From: Timur Tabi <ttabi@nvidia.com>
-
-[ Upstream commit c1dca0cb0e761568c448a6007855fe5879ad4d37 ]
-
-Although GA100 uses the same GSP-RM firmware as Turing, it has a different
-signature specifically for it.
-
-Fixes: 121ea04cd9f2 ("gpu: nova-core: add support for Turing/GA100 fwsignature")
-Signed-off-by: Timur Tabi <ttabi@nvidia.com>
-Reviewed-by: Eliot Courtney <ecourtney@nvidia.com>
-Reviewed-by: Gary Guo <gary@garyguo.net>
-Link: https://patch.msgid.link/20260417191359.1307434-2-ttabi@nvidia.com
-Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/nova-core/firmware/gsp.rs | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/nova-core/firmware/gsp.rs b/drivers/gpu/nova-core/firmware/gsp.rs
-index 2fcc255c3bc81b..c423191b21f018 100644
---- a/drivers/gpu/nova-core/firmware/gsp.rs
-+++ b/drivers/gpu/nova-core/firmware/gsp.rs
-@@ -138,8 +138,7 @@ impl GspFirmware {
- ".fwsignature_tu11x"
- }
- Architecture::Turing => ".fwsignature_tu10x",
-- // GA100 uses the same firmware as Turing
-- Architecture::Ampere if chipset == Chipset::GA100 => ".fwsignature_tu10x",
-+ Architecture::Ampere if chipset == Chipset::GA100 => ".fwsignature_ga100",
- Architecture::Ampere => ".fwsignature_ga10x",
- Architecture::Ada => ".fwsignature_ad10x",
- };
---
-2.53.0
-
+++ /dev/null
-From d868792cc4b2c2d72f4c02c3e60c99969cdcb044 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 May 2026 22:57:21 +0900
-Subject: gpu: nova-core: vbios: avoid reading too far in read_more_at_offset
-
-From: Eliot Courtney <ecourtney@nvidia.com>
-
-[ Upstream commit 33f1402bcfa6cfd85fa265ce6fa5c6bb7d981c6d ]
-
-Fix bug where `read_more_at_offset` would unnecessarily read more data.
-This happens when the window to read has some part cached and some part
-not. It would read `len` bytes instead of just the uncached portion,
-which could read past `BIOS_MAX_SCAN_LEN`.
-
-Fixes: 6fda04e7f0cd ("gpu: nova-core: vbios: Add base support for VBIOS construction and iteration")
-Reviewed-by: John Hubbard <jhubbard@nvidia.com>
-Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
-Link: https://patch.msgid.link/20260525-fix-vbios-v5-3-e5e455251537@nvidia.com
-Signed-off-by: Danilo Krummrich <dakr@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/nova-core/vbios.rs | 25 +++++++++++--------------
- 1 file changed, 11 insertions(+), 14 deletions(-)
-
-diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs
-index d25f9a11228009..10473279ebeaf7 100644
---- a/drivers/gpu/nova-core/vbios.rs
-+++ b/drivers/gpu/nova-core/vbios.rs
-@@ -102,8 +102,13 @@ impl<'a> VbiosIterator<'a> {
-
- /// Read bytes from the ROM at the current end of the data vector.
- fn read_more(&mut self, len: usize) -> Result {
-- let current_len = self.data.len();
-- let start = ROM_OFFSET + current_len;
-+ let start = self.data.len();
-+ let end = start + len;
-+
-+ if end > BIOS_MAX_SCAN_LEN {
-+ dev_err!(self.dev, "Error: exceeded BIOS scan limit.\n");
-+ return Err(EINVAL);
-+ }
-
- // Ensure length is a multiple of 4 for 32-bit reads
- if len % core::mem::size_of::<u32>() != 0 {
-@@ -117,9 +122,9 @@ impl<'a> VbiosIterator<'a> {
-
- self.data.reserve(len, GFP_KERNEL)?;
- // Read ROM data bytes and push directly to `data`.
-- for addr in (start..start + len).step_by(core::mem::size_of::<u32>()) {
-+ for addr in (start..end).step_by(core::mem::size_of::<u32>()) {
- // Read 32-bit word from the VBIOS ROM
-- let word = self.bar0.try_read32(addr)?;
-+ let word = self.bar0.try_read32(ROM_OFFSET + addr)?;
-
- // Convert the `u32` to a 4 byte array and push each byte.
- word.to_ne_bytes()
-@@ -132,17 +137,9 @@ impl<'a> VbiosIterator<'a> {
-
- /// Read bytes at a specific offset, filling any gap.
- fn read_more_at_offset(&mut self, offset: usize, len: usize) -> Result {
-- if offset > BIOS_MAX_SCAN_LEN {
-- dev_err!(self.dev, "Error: exceeded BIOS scan limit.\n");
-- return Err(EINVAL);
-- }
--
-- // If `offset` is beyond current data size, fill the gap first.
-- let current_len = self.data.len();
-- let gap_bytes = offset.saturating_sub(current_len);
-+ let end = offset.checked_add(len).ok_or(EINVAL)?;
-
-- // Now read the requested bytes at the offset.
-- self.read_more(gap_bytes + len)
-+ self.read_more(end.saturating_sub(self.data.len()))
- }
-
- /// Read a BIOS image at a specific offset and create a [`BiosImage`] from it.
---
-2.53.0
-
+++ /dev/null
-From 2ba4ef08857bd4d59d7a4ee8b41df5d4637b625d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 May 2026 22:57:22 +0900
-Subject: gpu: nova-core: vbios: read BitToken using FromBytes
-
-From: Eliot Courtney <ecourtney@nvidia.com>
-
-[ Upstream commit 237c252be0db616c93e4984369db7e74bb797564 ]
-
-If `header.token_size` is smaller than `BitToken`, then we currently can
-read past the end of `image.base.data`. Use checked arithmetic for
-computing offsets and simplify reading it in using `FromBytes`.
-
-Fixes: dc70c6ae2441 ("gpu: nova-core: vbios: Add support to look up PMU table in FWSEC")
-Reviewed-by: John Hubbard <jhubbard@nvidia.com>
-Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
-Link: https://patch.msgid.link/20260525-fix-vbios-v5-4-e5e455251537@nvidia.com
-Signed-off-by: Danilo Krummrich <dakr@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/nova-core/vbios.rs | 39 +++++++++++++++++-----------------
- 1 file changed, 19 insertions(+), 20 deletions(-)
-
-diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs
-index 10473279ebeaf7..517d113e14137a 100644
---- a/drivers/gpu/nova-core/vbios.rs
-+++ b/drivers/gpu/nova-core/vbios.rs
-@@ -403,7 +403,7 @@ impl BitHeader {
-
- /// BIT Token Entry: Records in the BIT table followed by the BIT header.
- #[derive(Debug, Clone, Copy)]
--#[expect(dead_code)]
-+#[repr(C)]
- struct BitToken {
- /// 00h: Token identifier
- id: u8,
-@@ -415,6 +415,9 @@ struct BitToken {
- data_offset: u16,
- }
-
-+// SAFETY: all bit patterns are valid for `BitToken`.
-+unsafe impl FromBytes for BitToken {}
-+
- // Define the token ID for the Falcon data
- const BIT_TOKEN_ID_FALCON_DATA: u8 = 0x70;
-
-@@ -422,32 +425,28 @@ impl BitToken {
- /// Find a BIT token entry by BIT ID in a PciAtBiosImage
- fn from_id(image: &PciAtBiosImage, token_id: u8) -> Result<Self> {
- let header = &image.bit_header;
-+ let entry_size = usize::from(header.token_size);
-
- // Offset to the first token entry
- let tokens_start = image.bit_offset + usize::from(header.header_size);
-
- for i in 0..usize::from(header.token_entries) {
-- let entry_offset = tokens_start + (i * usize::from(header.token_size));
--
-- // Make sure we don't go out of bounds
-- if entry_offset + usize::from(header.token_size) > image.base.data.len() {
-- return Err(EINVAL);
-- }
-+ let entry_offset = i
-+ .checked_mul(entry_size)
-+ .and_then(|offset| tokens_start.checked_add(offset))
-+ .ok_or(EINVAL)?;
-+ let entry = image
-+ .base
-+ .data
-+ .get(entry_offset..)
-+ .and_then(|data| data.get(..entry_size))
-+ .ok_or(EINVAL)?;
-+
-+ let (token, _) = BitToken::from_bytes_copy_prefix(entry).ok_or(EINVAL)?;
-
- // Check if this token has the requested ID
-- if image.base.data[entry_offset] == token_id {
-- return Ok(BitToken {
-- id: image.base.data[entry_offset],
-- data_version: image.base.data[entry_offset + 1],
-- data_size: u16::from_le_bytes([
-- image.base.data[entry_offset + 2],
-- image.base.data[entry_offset + 3],
-- ]),
-- data_offset: u16::from_le_bytes([
-- image.base.data[entry_offset + 4],
-- image.base.data[entry_offset + 5],
-- ]),
-- });
-+ if token.id == token_id {
-+ return Ok(token);
- }
- }
-
---
-2.53.0
-
+++ /dev/null
-From 8616338862f4fbe9082583c0ebc8ac96e9f48395 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 May 2026 22:57:19 +0900
-Subject: gpu: nova-core: vbios: stop scanning at BIOS_MAX_SCAN_LEN
-
-From: Eliot Courtney <ecourtney@nvidia.com>
-
-[ Upstream commit fc7c1054b6f983ae2f3e100a24cc87908ae9f4b7 ]
-
-Current code lets `current_offset` go to `BIOS_MAX_SCAN_LEN` which is
-one byte too far.
-
-Fixes: 6fda04e7f0cd ("gpu: nova-core: vbios: Add base support for VBIOS construction and iteration")
-Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com>
-Reviewed-by: John Hubbard <jhubbard@nvidia.com>
-Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
-Link: https://patch.msgid.link/20260525-fix-vbios-v5-1-e5e455251537@nvidia.com
-Signed-off-by: Danilo Krummrich <dakr@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/nova-core/vbios.rs | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs
-index ebda28e596c5f0..871c1163f90a3d 100644
---- a/drivers/gpu/nova-core/vbios.rs
-+++ b/drivers/gpu/nova-core/vbios.rs
-@@ -189,7 +189,7 @@ impl<'a> Iterator for VbiosIterator<'a> {
- return None;
- }
-
-- if self.current_offset > BIOS_MAX_SCAN_LEN {
-+ if self.current_offset >= BIOS_MAX_SCAN_LEN {
- dev_err!(self.dev, "Error: exceeded BIOS scan limit, stopping scan\n");
- return None;
- }
---
-2.53.0
-
+++ /dev/null
-From dc4a327e4e3a0baa5780667a64dde9ac83e53589 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 May 2026 22:57:24 +0900
-Subject: gpu: nova-core: vbios: use checked access in `FwSecBiosImage::header`
-
-From: Eliot Courtney <ecourtney@nvidia.com>
-
-[ Upstream commit 25ad950b4ee37f7b42e006f508a793b7c38fcc12 ]
-
-Use checked access in `FwSecBiosImage::header` for getting the header
-version since the value is firmware derived.
-
-Fixes: 47c4846e4319 ("gpu: nova-core: vbios: Add support for FWSEC ucode extraction")
-Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com>
-Reviewed-by: John Hubbard <jhubbard@nvidia.com>
-Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
-Link: https://patch.msgid.link/20260525-fix-vbios-v5-6-e5e455251537@nvidia.com
-Signed-off-by: Danilo Krummrich <dakr@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/nova-core/vbios.rs | 17 +++++++----------
- 1 file changed, 7 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs
-index 10f812714e4dcd..394877d5b2eae1 100644
---- a/drivers/gpu/nova-core/vbios.rs
-+++ b/drivers/gpu/nova-core/vbios.rs
-@@ -994,17 +994,14 @@ impl FwSecBiosBuilder {
- impl FwSecBiosImage {
- /// Get the FwSec header ([`FalconUCodeDesc`]).
- pub(crate) fn header(&self) -> Result<FalconUCodeDesc> {
-- // Get the falcon ucode offset that was found in setup_falcon_data.
-- let falcon_ucode_offset = self.falcon_ucode_offset;
--
-- // Read the first 4 bytes to get the version.
-- let hdr_bytes: [u8; 4] = self.base.data[falcon_ucode_offset..falcon_ucode_offset + 4]
-- .try_into()
-- .map_err(|_| EINVAL)?;
-- let hdr = u32::from_le_bytes(hdr_bytes);
-- let ver = (hdr & 0xff00) >> 8;
-+ let data = self
-+ .base
-+ .data
-+ .get(self.falcon_ucode_offset..)
-+ .ok_or(EINVAL)?;
-
-- let data = self.base.data.get(falcon_ucode_offset..).ok_or(EINVAL)?;
-+ // Read the version byte from the header.
-+ let ver = data.get(1).copied().ok_or(EINVAL)?;
- match ver {
- 2 => {
- let v2 = FalconUCodeDescV2::from_bytes_copy_prefix(data)
---
-2.53.0
-
+++ /dev/null
-From 3be35c317f81b46331bf5a0124e03f6298462870 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 May 2026 22:57:25 +0900
-Subject: gpu: nova-core: vbios: use checked accesses in `setup_falcon_data`
-
-From: Eliot Courtney <ecourtney@nvidia.com>
-
-[ Upstream commit 051ae1b21ff7a3cc27522b0b3b56e277b62c1207 ]
-
-Use checked arithmetic for `ucode_offset` in `setup_falcon_data`. This
-prevents a malformed firmware from causing a panic.
-
-Fixes: dc70c6ae2441 ("gpu: nova-core: vbios: Add support to look up PMU table in FWSEC")
-Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com>
-Reviewed-by: John Hubbard <jhubbard@nvidia.com>
-Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
-Link: https://patch.msgid.link/20260525-fix-vbios-v5-7-e5e455251537@nvidia.com
-Signed-off-by: Danilo Krummrich <dakr@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/nova-core/vbios.rs | 17 +++++++++--------
- 1 file changed, 9 insertions(+), 8 deletions(-)
-
-diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs
-index 394877d5b2eae1..19361104a4cd3d 100644
---- a/drivers/gpu/nova-core/vbios.rs
-+++ b/drivers/gpu/nova-core/vbios.rs
-@@ -953,14 +953,15 @@ impl FwSecBiosBuilder {
- .find_entry_by_type(FALCON_UCODE_ENTRY_APPID_FWSEC_PROD)
- {
- Ok(entry) => {
-- let mut ucode_offset = usize::from_safe_cast(entry.data);
-- ucode_offset -= pci_at_image.base.data.len();
-- if ucode_offset < first_fwsec.base.data.len() {
-- dev_err!(self.base.dev, "Falcon Ucode offset not in second Fwsec.\n");
-- return Err(EINVAL);
-- }
-- ucode_offset -= first_fwsec.base.data.len();
-- self.falcon_ucode_offset = Some(ucode_offset);
-+ self.falcon_ucode_offset = Some(
-+ usize::from_safe_cast(entry.data)
-+ .checked_sub(pci_at_image.base.data.len())
-+ .and_then(|o| o.checked_sub(first_fwsec.base.data.len()))
-+ .ok_or(EINVAL)
-+ .inspect_err(|_| {
-+ dev_err!(self.base.dev, "Falcon Ucode offset not in second Fwsec.\n");
-+ })?,
-+ );
- }
- Err(e) => {
- dev_err!(
---
-2.53.0
-
+++ /dev/null
-From 71d9d6ad9ed464c49fa16de1c9fd1207162037fc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 May 2026 22:57:20 +0900
-Subject: gpu: nova-core: vbios: use checked arithmetic for bios image range
- end
-
-From: Eliot Courtney <ecourtney@nvidia.com>
-
-[ Upstream commit 7a1d09e477b6496f13f92b84ed9b2eab191b3366 ]
-
-`read_bios_image_at_offset` is called with a length from the VBIOS
-header, so we should be more defensive here and use checked arithmetic.
-
-Fixes: 6fda04e7f0cd ("gpu: nova-core: vbios: Add base support for VBIOS construction and iteration")
-Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com>
-Reviewed-by: John Hubbard <jhubbard@nvidia.com>
-Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
-Link: https://patch.msgid.link/20260525-fix-vbios-v5-2-e5e455251537@nvidia.com
-Signed-off-by: Danilo Krummrich <dakr@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/nova-core/vbios.rs | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs
-index 871c1163f90a3d..d25f9a11228009 100644
---- a/drivers/gpu/nova-core/vbios.rs
-+++ b/drivers/gpu/nova-core/vbios.rs
-@@ -155,8 +155,8 @@ impl<'a> VbiosIterator<'a> {
- len: usize,
- context: &str,
- ) -> Result<BiosImage> {
-- let data_len = self.data.len();
-- if offset + len > data_len {
-+ let end = offset.checked_add(len).ok_or(EINVAL)?;
-+ if end > self.data.len() {
- self.read_more_at_offset(offset, len).inspect_err(|e| {
- dev_err!(
- self.dev,
-@@ -167,7 +167,7 @@ impl<'a> VbiosIterator<'a> {
- })?;
- }
-
-- BiosImage::new(self.dev, &self.data[offset..offset + len]).inspect_err(|err| {
-+ BiosImage::new(self.dev, &self.data[offset..end]).inspect_err(|err| {
- dev_err!(
- self.dev,
- "Failed to {} at offset {:#x}: {:?}\n",
---
-2.53.0
-
+++ /dev/null
-From 186043e1a227e564afe78a26534cf33c784941b5 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 25 May 2026 22:57:23 +0900
-Subject: gpu: nova-core: vbios: use checked ops and accesses in
- `FwSecBiosImage::ucode`
-
-From: Eliot Courtney <ecourtney@nvidia.com>
-
-[ Upstream commit 7c62d0b006527efc5fb4609b555c65674c819603 ]
-
-Use checked arithmetic and access for extracting the microcode since the
-offsets are firmware derived.
-
-Fixes: 47c4846e4319 ("gpu: nova-core: vbios: Add support for FWSEC ucode extraction")
-Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com>
-Reviewed-by: John Hubbard <jhubbard@nvidia.com>
-Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
-Link: https://patch.msgid.link/20260525-fix-vbios-v5-5-e5e455251537@nvidia.com
-Signed-off-by: Danilo Krummrich <dakr@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/nova-core/vbios.rs | 14 ++++++++------
- 1 file changed, 8 insertions(+), 6 deletions(-)
-
-diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs
-index 517d113e14137a..10f812714e4dcd 100644
---- a/drivers/gpu/nova-core/vbios.rs
-+++ b/drivers/gpu/nova-core/vbios.rs
-@@ -1027,16 +1027,18 @@ impl FwSecBiosImage {
-
- /// Get the ucode data as a byte slice
- pub(crate) fn ucode(&self, desc: &FalconUCodeDesc) -> Result<&[u8]> {
-- let falcon_ucode_offset = self.falcon_ucode_offset;
-+ let size = usize::from_safe_cast(
-+ desc.imem_load_size()
-+ .checked_add(desc.dmem_load_size())
-+ .ok_or(ERANGE)?,
-+ );
-
- // The ucode data follows the descriptor.
-- let ucode_data_offset = falcon_ucode_offset + desc.size();
-- let size = usize::from_safe_cast(desc.imem_load_size() + desc.dmem_load_size());
--
-- // Get the data slice, checking bounds in a single operation.
- self.base
- .data
-- .get(ucode_data_offset..ucode_data_offset + size)
-+ .get(self.falcon_ucode_offset..)
-+ .and_then(|data| data.get(desc.size()..))
-+ .and_then(|data| data.get(..size))
- .ok_or(ERANGE)
- .inspect_err(|_| {
- dev_err!(
---
-2.53.0
-
pinctrl-pinconf-generic-fix-properties-bitmap-leak-i.patch
drm-amdkfd-validate-criu-restored-ids-before-idr_all.patch
driver-core-use-read_once-for-dev-driver-in-dev_has_.patch
-gpu-nova-core-use-correct-fwsignature-for-ga100.patch
wifi-rtw89-fix-wrong-pci_get_drvdata-type-in-aer-han.patch
wifi-rtw88-fix-wrong-pci_get_drvdata-type-in-aer-han.patch
wifi-rtw89-correct-data-type-for-scan-index-to-avoid.patch
rdma-irdma-fix-out-of-bounds-write-in-irdma_copy_use.patch
rdma-rxe-fix-a-use-after-free-problem-in-rxe_mmap.patch
ib-mlx4-fix-refcount-leak-in-add_port-error-path.patch
-gpu-nova-core-vbios-stop-scanning-at-bios_max_scan_l.patch
-gpu-nova-core-vbios-use-checked-arithmetic-for-bios-.patch
-gpu-nova-core-vbios-avoid-reading-too-far-in-read_mo.patch
-gpu-nova-core-vbios-read-bittoken-using-frombytes.patch
-gpu-nova-core-vbios-use-checked-ops-and-accesses-in-.patch
-gpu-nova-core-vbios-use-checked-access-in-fwsecbiosi.patch
-gpu-nova-core-vbios-use-checked-accesses-in-setup_fa.patch
rdma-hns-fix-warning-in-poll-cq-direct-mode.patch
rdma-hns-fix-log-flood-after-cmd_mbox-failure.patch
acpi-pad-fix-teardown-ordering-in-acpi_pad_remove.patch
netfilter-xt_nat-reject-unsupported-target-families.patch
netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch
netfilter-flowtable-use-correct-direction-to-set-up-tunnel-route.patch
-gpu-nova-core-simplify-and_then-with-condition-to-filter.patch
gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch
gpu-buddy-bail-out-of-try_harder-when-alignment-cannot-be-honoured.patch
soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
