From 5f5237410773783c066c6c05bd502a34a95c6e8a Mon Sep 17 00:00:00 2001 From: Eliot Courtney Date: Fri, 3 Jul 2026 19:22:05 +0900 Subject: [PATCH] gpu: nova-core: fsp: limit FSP receive message allocation size Currently, the FSP receive message code will try to allocate whatever was sent without checking it at all. But the actual size allowed is limited to 1024 anyway, so reject any messages over that size as bogus. Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260703-blackwell-fixes-v2-1-8e3d8bc32bb9@nvidia.com [acourbot: use `SZ_1K` constant for size.] Signed-off-by: Alexandre Courbot --- drivers/gpu/nova-core/falcon/fsp.rs | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/nova-core/falcon/fsp.rs b/drivers/gpu/nova-core/falcon/fsp.rs index 53b1079843ae..9d7322de1ce4 100644 --- a/drivers/gpu/nova-core/falcon/fsp.rs +++ b/drivers/gpu/nova-core/falcon/fsp.rs @@ -17,6 +17,7 @@ Io, // }, prelude::*, + sizes::SZ_1K, time::Delta, }; @@ -34,6 +35,9 @@ /// FSP message timeout in milliseconds. const FSP_MSG_TIMEOUT_MS: i64 = 2000; +/// Size of the FSP EMEM channel 0 that we can use. +const FSP_EMEM_CHANNEL_0_SIZE: usize = SZ_1K; + /// Type specifying the `Fsp` falcon engine. Cannot be instantiated. pub(crate) struct Fsp(()); @@ -159,6 +163,11 @@ pub(crate) fn recv_msg(&mut self) -> Result> { ) .map(num::u32_as_usize)?; + // Don't blindly allocate more than the maximum we expect from FSP. + if msg_size > FSP_EMEM_CHANNEL_0_SIZE { + return Err(EMSGSIZE); + } + let mut buffer = KVec::::new(); buffer.resize(msg_size, 0, GFP_KERNEL)?;