From: Greg Kroah-Hartman Date: Fri, 24 Jul 2026 11:28:24 +0000 (+0200) Subject: drop nova patches from 7.1 X-Git-Tag: v5.10.261~2 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=b1487b8e03dabfabce306b6f440455c294e005c4;p=thirdparty%2Fkernel%2Fstable-queue.git drop nova patches from 7.1 --- diff --git a/queue-7.1/gpu-nova-core-simplify-and_then-with-condition-to-filter.patch b/queue-7.1/gpu-nova-core-simplify-and_then-with-condition-to-filter.patch deleted file mode 100644 index 97c950fc4b..0000000000 --- a/queue-7.1/gpu-nova-core-simplify-and_then-with-condition-to-filter.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 16df3873c80388a71c4695909a51be0c809b889c Mon Sep 17 00:00:00 2001 -From: Eliot Courtney -Date: Thu, 23 Apr 2026 16:11:44 +0900 -Subject: gpu: nova-core: simplify and_then with condition to filter - -From: Eliot Courtney - -commit 16df3873c80388a71c4695909a51be0c809b889c upstream. - -This code is more simply expressed using Option::filter instead of the -and_then with conditional. - -This fixes the following warning with latest nightly Rust clippy build: - -warning: manual implementation of `Option::filter` - --> drivers/gpu/nova-core/firmware.rs:391:14 - | -391 | .and_then(|hdr| { - | ______________^ -392 | | if hdr.bin_magic == BIN_MAGIC { -393 | | Some(hdr) -394 | | } else { -... | -397 | | }) - | |______________^ help: try: `filter(|hdr| hdr.bin_magic == BIN_MAGIC)` - | - = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#manual_filter - = note: `-D clippy::manual-filter` implied by `-D warnings` - = help: to override `-D warnings` add `#[allow(clippy::manual_filter)]` - -Cc: stable@vger.kernel.org -Fixes: d6cb7319e64e ("gpu: nova-core: firmware: add support for common firmware header") -Signed-off-by: Eliot Courtney -Acked-by: Danilo Krummrich -Reviewed-by: Alice Ryhl -Reviewed-by: Gary Guo -Link: https://patch.msgid.link/20260423-fix-filter-v1-1-b3b197c65daf@nvidia.com -[aliceryhl: add Fixes: tag and quote the warning it fixes] -Signed-off-by: Alice Ryhl -Signed-off-by: Greg Kroah-Hartman ---- - drivers/gpu/nova-core/firmware.rs | 8 +------- - 1 file changed, 1 insertion(+), 7 deletions(-) - ---- a/drivers/gpu/nova-core/firmware.rs -+++ b/drivers/gpu/nova-core/firmware.rs -@@ -388,13 +388,7 @@ impl<'a> BinFirmware<'a> { - // Extract header. - .and_then(BinHdr::from_bytes_copy) - // Validate header. -- .and_then(|hdr| { -- if hdr.bin_magic == BIN_MAGIC { -- Some(hdr) -- } else { -- None -- } -- }) -+ .filter(|hdr| hdr.bin_magic == BIN_MAGIC) - .map(|hdr| Self { hdr, fw }) - .ok_or(EINVAL) - } diff --git a/queue-7.1/gpu-nova-core-use-correct-fwsignature-for-ga100.patch b/queue-7.1/gpu-nova-core-use-correct-fwsignature-for-ga100.patch deleted file mode 100644 index 65117028bf..0000000000 --- a/queue-7.1/gpu-nova-core-use-correct-fwsignature-for-ga100.patch +++ /dev/null @@ -1,40 +0,0 @@ -From f08ff82e444310bca694da7a6d4b3ddf4c8488b1 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 17 Apr 2026 14:13:54 -0500 -Subject: gpu: nova-core: use correct fwsignature for GA100 - -From: Timur Tabi - -[ Upstream commit c1dca0cb0e761568c448a6007855fe5879ad4d37 ] - -Although GA100 uses the same GSP-RM firmware as Turing, it has a different -signature specifically for it. - -Fixes: 121ea04cd9f2 ("gpu: nova-core: add support for Turing/GA100 fwsignature") -Signed-off-by: Timur Tabi -Reviewed-by: Eliot Courtney -Reviewed-by: Gary Guo -Link: https://patch.msgid.link/20260417191359.1307434-2-ttabi@nvidia.com -Signed-off-by: Alexandre Courbot -Signed-off-by: Sasha Levin ---- - drivers/gpu/nova-core/firmware/gsp.rs | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/gpu/nova-core/firmware/gsp.rs b/drivers/gpu/nova-core/firmware/gsp.rs -index 2fcc255c3bc81b..c423191b21f018 100644 ---- a/drivers/gpu/nova-core/firmware/gsp.rs -+++ b/drivers/gpu/nova-core/firmware/gsp.rs -@@ -138,8 +138,7 @@ impl GspFirmware { - ".fwsignature_tu11x" - } - Architecture::Turing => ".fwsignature_tu10x", -- // GA100 uses the same firmware as Turing -- Architecture::Ampere if chipset == Chipset::GA100 => ".fwsignature_tu10x", -+ Architecture::Ampere if chipset == Chipset::GA100 => ".fwsignature_ga100", - Architecture::Ampere => ".fwsignature_ga10x", - Architecture::Ada => ".fwsignature_ad10x", - }; --- -2.53.0 - diff --git a/queue-7.1/gpu-nova-core-vbios-avoid-reading-too-far-in-read_mo.patch b/queue-7.1/gpu-nova-core-vbios-avoid-reading-too-far-in-read_mo.patch deleted file mode 100644 index 3bfc4ad5cb..0000000000 --- a/queue-7.1/gpu-nova-core-vbios-avoid-reading-too-far-in-read_mo.patch +++ /dev/null @@ -1,79 +0,0 @@ -From d868792cc4b2c2d72f4c02c3e60c99969cdcb044 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 25 May 2026 22:57:21 +0900 -Subject: gpu: nova-core: vbios: avoid reading too far in read_more_at_offset - -From: Eliot Courtney - -[ Upstream commit 33f1402bcfa6cfd85fa265ce6fa5c6bb7d981c6d ] - -Fix bug where `read_more_at_offset` would unnecessarily read more data. -This happens when the window to read has some part cached and some part -not. It would read `len` bytes instead of just the uncached portion, -which could read past `BIOS_MAX_SCAN_LEN`. - -Fixes: 6fda04e7f0cd ("gpu: nova-core: vbios: Add base support for VBIOS construction and iteration") -Reviewed-by: John Hubbard -Signed-off-by: Eliot Courtney -Link: https://patch.msgid.link/20260525-fix-vbios-v5-3-e5e455251537@nvidia.com -Signed-off-by: Danilo Krummrich -Signed-off-by: Sasha Levin ---- - drivers/gpu/nova-core/vbios.rs | 25 +++++++++++-------------- - 1 file changed, 11 insertions(+), 14 deletions(-) - -diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs -index d25f9a11228009..10473279ebeaf7 100644 ---- a/drivers/gpu/nova-core/vbios.rs -+++ b/drivers/gpu/nova-core/vbios.rs -@@ -102,8 +102,13 @@ impl<'a> VbiosIterator<'a> { - - /// Read bytes from the ROM at the current end of the data vector. - fn read_more(&mut self, len: usize) -> Result { -- let current_len = self.data.len(); -- let start = ROM_OFFSET + current_len; -+ let start = self.data.len(); -+ let end = start + len; -+ -+ if end > BIOS_MAX_SCAN_LEN { -+ dev_err!(self.dev, "Error: exceeded BIOS scan limit.\n"); -+ return Err(EINVAL); -+ } - - // Ensure length is a multiple of 4 for 32-bit reads - if len % core::mem::size_of::() != 0 { -@@ -117,9 +122,9 @@ impl<'a> VbiosIterator<'a> { - - self.data.reserve(len, GFP_KERNEL)?; - // Read ROM data bytes and push directly to `data`. -- for addr in (start..start + len).step_by(core::mem::size_of::()) { -+ for addr in (start..end).step_by(core::mem::size_of::()) { - // Read 32-bit word from the VBIOS ROM -- let word = self.bar0.try_read32(addr)?; -+ let word = self.bar0.try_read32(ROM_OFFSET + addr)?; - - // Convert the `u32` to a 4 byte array and push each byte. - word.to_ne_bytes() -@@ -132,17 +137,9 @@ impl<'a> VbiosIterator<'a> { - - /// Read bytes at a specific offset, filling any gap. - fn read_more_at_offset(&mut self, offset: usize, len: usize) -> Result { -- if offset > BIOS_MAX_SCAN_LEN { -- dev_err!(self.dev, "Error: exceeded BIOS scan limit.\n"); -- return Err(EINVAL); -- } -- -- // If `offset` is beyond current data size, fill the gap first. -- let current_len = self.data.len(); -- let gap_bytes = offset.saturating_sub(current_len); -+ let end = offset.checked_add(len).ok_or(EINVAL)?; - -- // Now read the requested bytes at the offset. -- self.read_more(gap_bytes + len) -+ self.read_more(end.saturating_sub(self.data.len())) - } - - /// Read a BIOS image at a specific offset and create a [`BiosImage`] from it. --- -2.53.0 - diff --git a/queue-7.1/gpu-nova-core-vbios-read-bittoken-using-frombytes.patch b/queue-7.1/gpu-nova-core-vbios-read-bittoken-using-frombytes.patch deleted file mode 100644 index ebc9d871e6..0000000000 --- a/queue-7.1/gpu-nova-core-vbios-read-bittoken-using-frombytes.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 2ba4ef08857bd4d59d7a4ee8b41df5d4637b625d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 25 May 2026 22:57:22 +0900 -Subject: gpu: nova-core: vbios: read BitToken using FromBytes - -From: Eliot Courtney - -[ Upstream commit 237c252be0db616c93e4984369db7e74bb797564 ] - -If `header.token_size` is smaller than `BitToken`, then we currently can -read past the end of `image.base.data`. Use checked arithmetic for -computing offsets and simplify reading it in using `FromBytes`. - -Fixes: dc70c6ae2441 ("gpu: nova-core: vbios: Add support to look up PMU table in FWSEC") -Reviewed-by: John Hubbard -Signed-off-by: Eliot Courtney -Link: https://patch.msgid.link/20260525-fix-vbios-v5-4-e5e455251537@nvidia.com -Signed-off-by: Danilo Krummrich -Signed-off-by: Sasha Levin ---- - drivers/gpu/nova-core/vbios.rs | 39 +++++++++++++++++----------------- - 1 file changed, 19 insertions(+), 20 deletions(-) - -diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs -index 10473279ebeaf7..517d113e14137a 100644 ---- a/drivers/gpu/nova-core/vbios.rs -+++ b/drivers/gpu/nova-core/vbios.rs -@@ -403,7 +403,7 @@ impl BitHeader { - - /// BIT Token Entry: Records in the BIT table followed by the BIT header. - #[derive(Debug, Clone, Copy)] --#[expect(dead_code)] -+#[repr(C)] - struct BitToken { - /// 00h: Token identifier - id: u8, -@@ -415,6 +415,9 @@ struct BitToken { - data_offset: u16, - } - -+// SAFETY: all bit patterns are valid for `BitToken`. -+unsafe impl FromBytes for BitToken {} -+ - // Define the token ID for the Falcon data - const BIT_TOKEN_ID_FALCON_DATA: u8 = 0x70; - -@@ -422,32 +425,28 @@ impl BitToken { - /// Find a BIT token entry by BIT ID in a PciAtBiosImage - fn from_id(image: &PciAtBiosImage, token_id: u8) -> Result { - let header = &image.bit_header; -+ let entry_size = usize::from(header.token_size); - - // Offset to the first token entry - let tokens_start = image.bit_offset + usize::from(header.header_size); - - for i in 0..usize::from(header.token_entries) { -- let entry_offset = tokens_start + (i * usize::from(header.token_size)); -- -- // Make sure we don't go out of bounds -- if entry_offset + usize::from(header.token_size) > image.base.data.len() { -- return Err(EINVAL); -- } -+ let entry_offset = i -+ .checked_mul(entry_size) -+ .and_then(|offset| tokens_start.checked_add(offset)) -+ .ok_or(EINVAL)?; -+ let entry = image -+ .base -+ .data -+ .get(entry_offset..) -+ .and_then(|data| data.get(..entry_size)) -+ .ok_or(EINVAL)?; -+ -+ let (token, _) = BitToken::from_bytes_copy_prefix(entry).ok_or(EINVAL)?; - - // Check if this token has the requested ID -- if image.base.data[entry_offset] == token_id { -- return Ok(BitToken { -- id: image.base.data[entry_offset], -- data_version: image.base.data[entry_offset + 1], -- data_size: u16::from_le_bytes([ -- image.base.data[entry_offset + 2], -- image.base.data[entry_offset + 3], -- ]), -- data_offset: u16::from_le_bytes([ -- image.base.data[entry_offset + 4], -- image.base.data[entry_offset + 5], -- ]), -- }); -+ if token.id == token_id { -+ return Ok(token); - } - } - --- -2.53.0 - diff --git a/queue-7.1/gpu-nova-core-vbios-stop-scanning-at-bios_max_scan_l.patch b/queue-7.1/gpu-nova-core-vbios-stop-scanning-at-bios_max_scan_l.patch deleted file mode 100644 index efffe67e0a..0000000000 --- a/queue-7.1/gpu-nova-core-vbios-stop-scanning-at-bios_max_scan_l.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 8616338862f4fbe9082583c0ebc8ac96e9f48395 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 25 May 2026 22:57:19 +0900 -Subject: gpu: nova-core: vbios: stop scanning at BIOS_MAX_SCAN_LEN - -From: Eliot Courtney - -[ Upstream commit fc7c1054b6f983ae2f3e100a24cc87908ae9f4b7 ] - -Current code lets `current_offset` go to `BIOS_MAX_SCAN_LEN` which is -one byte too far. - -Fixes: 6fda04e7f0cd ("gpu: nova-core: vbios: Add base support for VBIOS construction and iteration") -Reviewed-by: Joel Fernandes -Reviewed-by: John Hubbard -Signed-off-by: Eliot Courtney -Link: https://patch.msgid.link/20260525-fix-vbios-v5-1-e5e455251537@nvidia.com -Signed-off-by: Danilo Krummrich -Signed-off-by: Sasha Levin ---- - drivers/gpu/nova-core/vbios.rs | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs -index ebda28e596c5f0..871c1163f90a3d 100644 ---- a/drivers/gpu/nova-core/vbios.rs -+++ b/drivers/gpu/nova-core/vbios.rs -@@ -189,7 +189,7 @@ impl<'a> Iterator for VbiosIterator<'a> { - return None; - } - -- if self.current_offset > BIOS_MAX_SCAN_LEN { -+ if self.current_offset >= BIOS_MAX_SCAN_LEN { - dev_err!(self.dev, "Error: exceeded BIOS scan limit, stopping scan\n"); - return None; - } --- -2.53.0 - diff --git a/queue-7.1/gpu-nova-core-vbios-use-checked-access-in-fwsecbiosi.patch b/queue-7.1/gpu-nova-core-vbios-use-checked-access-in-fwsecbiosi.patch deleted file mode 100644 index 5ba9b9b2b7..0000000000 --- a/queue-7.1/gpu-nova-core-vbios-use-checked-access-in-fwsecbiosi.patch +++ /dev/null @@ -1,55 +0,0 @@ -From dc4a327e4e3a0baa5780667a64dde9ac83e53589 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 25 May 2026 22:57:24 +0900 -Subject: gpu: nova-core: vbios: use checked access in `FwSecBiosImage::header` - -From: Eliot Courtney - -[ Upstream commit 25ad950b4ee37f7b42e006f508a793b7c38fcc12 ] - -Use checked access in `FwSecBiosImage::header` for getting the header -version since the value is firmware derived. - -Fixes: 47c4846e4319 ("gpu: nova-core: vbios: Add support for FWSEC ucode extraction") -Reviewed-by: Joel Fernandes -Reviewed-by: John Hubbard -Signed-off-by: Eliot Courtney -Link: https://patch.msgid.link/20260525-fix-vbios-v5-6-e5e455251537@nvidia.com -Signed-off-by: Danilo Krummrich -Signed-off-by: Sasha Levin ---- - drivers/gpu/nova-core/vbios.rs | 17 +++++++---------- - 1 file changed, 7 insertions(+), 10 deletions(-) - -diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs -index 10f812714e4dcd..394877d5b2eae1 100644 ---- a/drivers/gpu/nova-core/vbios.rs -+++ b/drivers/gpu/nova-core/vbios.rs -@@ -994,17 +994,14 @@ impl FwSecBiosBuilder { - impl FwSecBiosImage { - /// Get the FwSec header ([`FalconUCodeDesc`]). - pub(crate) fn header(&self) -> Result { -- // Get the falcon ucode offset that was found in setup_falcon_data. -- let falcon_ucode_offset = self.falcon_ucode_offset; -- -- // Read the first 4 bytes to get the version. -- let hdr_bytes: [u8; 4] = self.base.data[falcon_ucode_offset..falcon_ucode_offset + 4] -- .try_into() -- .map_err(|_| EINVAL)?; -- let hdr = u32::from_le_bytes(hdr_bytes); -- let ver = (hdr & 0xff00) >> 8; -+ let data = self -+ .base -+ .data -+ .get(self.falcon_ucode_offset..) -+ .ok_or(EINVAL)?; - -- let data = self.base.data.get(falcon_ucode_offset..).ok_or(EINVAL)?; -+ // Read the version byte from the header. -+ let ver = data.get(1).copied().ok_or(EINVAL)?; - match ver { - 2 => { - let v2 = FalconUCodeDescV2::from_bytes_copy_prefix(data) --- -2.53.0 - diff --git a/queue-7.1/gpu-nova-core-vbios-use-checked-accesses-in-setup_fa.patch b/queue-7.1/gpu-nova-core-vbios-use-checked-accesses-in-setup_fa.patch deleted file mode 100644 index e412632cc8..0000000000 --- a/queue-7.1/gpu-nova-core-vbios-use-checked-accesses-in-setup_fa.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 3be35c317f81b46331bf5a0124e03f6298462870 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 25 May 2026 22:57:25 +0900 -Subject: gpu: nova-core: vbios: use checked accesses in `setup_falcon_data` - -From: Eliot Courtney - -[ Upstream commit 051ae1b21ff7a3cc27522b0b3b56e277b62c1207 ] - -Use checked arithmetic for `ucode_offset` in `setup_falcon_data`. This -prevents a malformed firmware from causing a panic. - -Fixes: dc70c6ae2441 ("gpu: nova-core: vbios: Add support to look up PMU table in FWSEC") -Reviewed-by: Joel Fernandes -Reviewed-by: John Hubbard -Signed-off-by: Eliot Courtney -Link: https://patch.msgid.link/20260525-fix-vbios-v5-7-e5e455251537@nvidia.com -Signed-off-by: Danilo Krummrich -Signed-off-by: Sasha Levin ---- - drivers/gpu/nova-core/vbios.rs | 17 +++++++++-------- - 1 file changed, 9 insertions(+), 8 deletions(-) - -diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs -index 394877d5b2eae1..19361104a4cd3d 100644 ---- a/drivers/gpu/nova-core/vbios.rs -+++ b/drivers/gpu/nova-core/vbios.rs -@@ -953,14 +953,15 @@ impl FwSecBiosBuilder { - .find_entry_by_type(FALCON_UCODE_ENTRY_APPID_FWSEC_PROD) - { - Ok(entry) => { -- let mut ucode_offset = usize::from_safe_cast(entry.data); -- ucode_offset -= pci_at_image.base.data.len(); -- if ucode_offset < first_fwsec.base.data.len() { -- dev_err!(self.base.dev, "Falcon Ucode offset not in second Fwsec.\n"); -- return Err(EINVAL); -- } -- ucode_offset -= first_fwsec.base.data.len(); -- self.falcon_ucode_offset = Some(ucode_offset); -+ self.falcon_ucode_offset = Some( -+ usize::from_safe_cast(entry.data) -+ .checked_sub(pci_at_image.base.data.len()) -+ .and_then(|o| o.checked_sub(first_fwsec.base.data.len())) -+ .ok_or(EINVAL) -+ .inspect_err(|_| { -+ dev_err!(self.base.dev, "Falcon Ucode offset not in second Fwsec.\n"); -+ })?, -+ ); - } - Err(e) => { - dev_err!( --- -2.53.0 - diff --git a/queue-7.1/gpu-nova-core-vbios-use-checked-arithmetic-for-bios-.patch b/queue-7.1/gpu-nova-core-vbios-use-checked-arithmetic-for-bios-.patch deleted file mode 100644 index a6b29ca5b8..0000000000 --- a/queue-7.1/gpu-nova-core-vbios-use-checked-arithmetic-for-bios-.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 71d9d6ad9ed464c49fa16de1c9fd1207162037fc Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 25 May 2026 22:57:20 +0900 -Subject: gpu: nova-core: vbios: use checked arithmetic for bios image range - end - -From: Eliot Courtney - -[ Upstream commit 7a1d09e477b6496f13f92b84ed9b2eab191b3366 ] - -`read_bios_image_at_offset` is called with a length from the VBIOS -header, so we should be more defensive here and use checked arithmetic. - -Fixes: 6fda04e7f0cd ("gpu: nova-core: vbios: Add base support for VBIOS construction and iteration") -Reviewed-by: Joel Fernandes -Reviewed-by: John Hubbard -Signed-off-by: Eliot Courtney -Link: https://patch.msgid.link/20260525-fix-vbios-v5-2-e5e455251537@nvidia.com -Signed-off-by: Danilo Krummrich -Signed-off-by: Sasha Levin ---- - drivers/gpu/nova-core/vbios.rs | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs -index 871c1163f90a3d..d25f9a11228009 100644 ---- a/drivers/gpu/nova-core/vbios.rs -+++ b/drivers/gpu/nova-core/vbios.rs -@@ -155,8 +155,8 @@ impl<'a> VbiosIterator<'a> { - len: usize, - context: &str, - ) -> Result { -- let data_len = self.data.len(); -- if offset + len > data_len { -+ let end = offset.checked_add(len).ok_or(EINVAL)?; -+ if end > self.data.len() { - self.read_more_at_offset(offset, len).inspect_err(|e| { - dev_err!( - self.dev, -@@ -167,7 +167,7 @@ impl<'a> VbiosIterator<'a> { - })?; - } - -- BiosImage::new(self.dev, &self.data[offset..offset + len]).inspect_err(|err| { -+ BiosImage::new(self.dev, &self.data[offset..end]).inspect_err(|err| { - dev_err!( - self.dev, - "Failed to {} at offset {:#x}: {:?}\n", --- -2.53.0 - diff --git a/queue-7.1/gpu-nova-core-vbios-use-checked-ops-and-accesses-in-.patch b/queue-7.1/gpu-nova-core-vbios-use-checked-ops-and-accesses-in-.patch deleted file mode 100644 index 0f91a1969c..0000000000 --- a/queue-7.1/gpu-nova-core-vbios-use-checked-ops-and-accesses-in-.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 186043e1a227e564afe78a26534cf33c784941b5 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 25 May 2026 22:57:23 +0900 -Subject: gpu: nova-core: vbios: use checked ops and accesses in - `FwSecBiosImage::ucode` - -From: Eliot Courtney - -[ Upstream commit 7c62d0b006527efc5fb4609b555c65674c819603 ] - -Use checked arithmetic and access for extracting the microcode since the -offsets are firmware derived. - -Fixes: 47c4846e4319 ("gpu: nova-core: vbios: Add support for FWSEC ucode extraction") -Reviewed-by: Joel Fernandes -Reviewed-by: John Hubbard -Signed-off-by: Eliot Courtney -Link: https://patch.msgid.link/20260525-fix-vbios-v5-5-e5e455251537@nvidia.com -Signed-off-by: Danilo Krummrich -Signed-off-by: Sasha Levin ---- - drivers/gpu/nova-core/vbios.rs | 14 ++++++++------ - 1 file changed, 8 insertions(+), 6 deletions(-) - -diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs -index 517d113e14137a..10f812714e4dcd 100644 ---- a/drivers/gpu/nova-core/vbios.rs -+++ b/drivers/gpu/nova-core/vbios.rs -@@ -1027,16 +1027,18 @@ impl FwSecBiosImage { - - /// Get the ucode data as a byte slice - pub(crate) fn ucode(&self, desc: &FalconUCodeDesc) -> Result<&[u8]> { -- let falcon_ucode_offset = self.falcon_ucode_offset; -+ let size = usize::from_safe_cast( -+ desc.imem_load_size() -+ .checked_add(desc.dmem_load_size()) -+ .ok_or(ERANGE)?, -+ ); - - // The ucode data follows the descriptor. -- let ucode_data_offset = falcon_ucode_offset + desc.size(); -- let size = usize::from_safe_cast(desc.imem_load_size() + desc.dmem_load_size()); -- -- // Get the data slice, checking bounds in a single operation. - self.base - .data -- .get(ucode_data_offset..ucode_data_offset + size) -+ .get(self.falcon_ucode_offset..) -+ .and_then(|data| data.get(desc.size()..)) -+ .and_then(|data| data.get(..size)) - .ok_or(ERANGE) - .inspect_err(|_| { - dev_err!( --- -2.53.0 - diff --git a/queue-7.1/series b/queue-7.1/series index a3910c8e14..0176d03f11 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -96,7 +96,6 @@ dt-bindings-pinctrl-nvidia-tegra234-add-missing-requ.patch pinctrl-pinconf-generic-fix-properties-bitmap-leak-i.patch drm-amdkfd-validate-criu-restored-ids-before-idr_all.patch driver-core-use-read_once-for-dev-driver-in-dev_has_.patch -gpu-nova-core-use-correct-fwsignature-for-ga100.patch wifi-rtw89-fix-wrong-pci_get_drvdata-type-in-aer-han.patch wifi-rtw88-fix-wrong-pci_get_drvdata-type-in-aer-han.patch wifi-rtw89-correct-data-type-for-scan-index-to-avoid.patch @@ -294,13 +293,6 @@ asoc-dapm-fix-widget-lookup-with-prefixed-names-acro.patch rdma-irdma-fix-out-of-bounds-write-in-irdma_copy_use.patch rdma-rxe-fix-a-use-after-free-problem-in-rxe_mmap.patch ib-mlx4-fix-refcount-leak-in-add_port-error-path.patch -gpu-nova-core-vbios-stop-scanning-at-bios_max_scan_l.patch -gpu-nova-core-vbios-use-checked-arithmetic-for-bios-.patch -gpu-nova-core-vbios-avoid-reading-too-far-in-read_mo.patch -gpu-nova-core-vbios-read-bittoken-using-frombytes.patch -gpu-nova-core-vbios-use-checked-ops-and-accesses-in-.patch -gpu-nova-core-vbios-use-checked-access-in-fwsecbiosi.patch -gpu-nova-core-vbios-use-checked-accesses-in-setup_fa.patch rdma-hns-fix-warning-in-poll-cq-direct-mode.patch rdma-hns-fix-log-flood-after-cmd_mbox-failure.patch acpi-pad-fix-teardown-ordering-in-acpi_pad_remove.patch @@ -1615,7 +1607,6 @@ netfilter-ecache-fix-inverted-time_after-check.patch netfilter-xt_nat-reject-unsupported-target-families.patch netfilter-bridge-fix-stale-prevhdr-pointer-in-br_ip6_fragment.patch netfilter-flowtable-use-correct-direction-to-set-up-tunnel-route.patch -gpu-nova-core-simplify-and_then-with-condition-to-filter.patch gpu-host1x-fix-device-reference-leak-in-host1x_device_parse_dt-error-path.patch gpu-buddy-bail-out-of-try_harder-when-alignment-cannot-be-honoured.patch soc-ti-k3-ringacc-fix-access-mode-for-k3_ringacc_ring_pop_tail_io-proxy.patch