From 5cdbed3ad782700d6381bf5901e3f61c4d8b28bc Mon Sep 17 00:00:00 2001 From: Eliot Courtney Date: Thu, 29 Jan 2026 16:45:03 +0900 Subject: [PATCH] gpu: nova-core: gsp: fix improper indexing in driver_read_area The current code indexes into `after_rx` using `tx` which is an index for the whole buffer, not the split buffer `after_rx`. Also add more rigorous no-panic proofs. Fixes: 75f6b1de8133 ("gpu: nova-core: gsp: Add GSP command queue bindings and handling") Signed-off-by: Eliot Courtney Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260129-nova-core-cmdq1-v3-5-2ede85493a27@nvidia.com Signed-off-by: Alexandre Courbot --- drivers/gpu/nova-core/gsp/cmdq.rs | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/nova-core/gsp/cmdq.rs b/drivers/gpu/nova-core/gsp/cmdq.rs index 333bf0125d74..16895f5281b7 100644 --- a/drivers/gpu/nova-core/gsp/cmdq.rs +++ b/drivers/gpu/nova-core/gsp/cmdq.rs @@ -1,7 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 use core::{ - cmp, mem, sync::atomic::{ fence, @@ -265,13 +264,19 @@ fn new(dev: &device::Device) -> Result { // - We will only access the driver-owned part of the shared memory. // - Per the safety statement of the function, no concurrent access will be performed. let gsp_mem = &unsafe { self.0.as_slice(0, 1) }.unwrap()[0]; - // PANIC: per the invariant of `cpu_read_ptr`, `rx` is `< MSGQ_NUM_PAGES`. - let (before_rx, after_rx) = gsp_mem.gspq.msgq.data.split_at(rx); + let data = &gsp_mem.gspq.msgq.data; - match tx.cmp(&rx) { - cmp::Ordering::Equal => (&[], &[]), - cmp::Ordering::Greater => (&after_rx[..tx], &[]), - cmp::Ordering::Less => (after_rx, &before_rx[..tx]), + // The area starting at `rx` and ending at `tx - 1` modulo MSGQ_NUM_PAGES, inclusive, + // belongs to the driver for reading. + // PANIC: + // - per the invariant of `cpu_read_ptr`, `rx < MSGQ_NUM_PAGES` + // - per the invariant of `gsp_write_ptr`, `tx < MSGQ_NUM_PAGES` + if rx <= tx { + // The area is contiguous. + (&data[rx..tx], &[]) + } else { + // The area is discontiguous. + (&data[rx..], &data[..tx]) } }