diff --git a/drivers/gpu/nova-core/falcon/fsp.rs b/drivers/gpu/nova-core/falcon/fsp.rs index 53b1079843ae..9d7322de1ce4 100644 --- a/drivers/gpu/nova-core/falcon/fsp.rs +++ b/drivers/gpu/nova-core/falcon/fsp.rs @@ -17,6 +17,7 @@ Io, // }, prelude::*, + sizes::SZ_1K, time::Delta, }; @@ -34,6 +35,9 @@ /// FSP message timeout in milliseconds. const FSP_MSG_TIMEOUT_MS: i64 = 2000; +/// Size of the FSP EMEM channel 0 that we can use. +const FSP_EMEM_CHANNEL_0_SIZE: usize = SZ_1K; + /// Type specifying the `Fsp` falcon engine. Cannot be instantiated. pub(crate) struct Fsp(()); @@ -159,6 +163,11 @@ pub(crate) fn recv_msg(&mut self) -> Result> { ) .map(num::u32_as_usize)?; + // Don't blindly allocate more than the maximum we expect from FSP. + if msg_size > FSP_EMEM_CHANNEL_0_SIZE { + return Err(EMSGSIZE); + } + let mut buffer = KVec::::new(); buffer.resize(msg_size, 0, GFP_KERNEL)?;