From 7a1d09e477b6496f13f92b84ed9b2eab191b3366 Mon Sep 17 00:00:00 2001 From: Eliot Courtney Date: Mon, 25 May 2026 22:57:20 +0900 Subject: [PATCH] gpu: nova-core: vbios: use checked arithmetic for bios image range end `read_bios_image_at_offset` is called with a length from the VBIOS header, so we should be more defensive here and use checked arithmetic. Fixes: 6fda04e7f0cd ("gpu: nova-core: vbios: Add base support for VBIOS construction and iteration") Reviewed-by: Joel Fernandes Reviewed-by: John Hubbard Signed-off-by: Eliot Courtney Link: https://patch.msgid.link/20260525-fix-vbios-v5-2-e5e455251537@nvidia.com Signed-off-by: Danilo Krummrich --- drivers/gpu/nova-core/vbios.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/nova-core/vbios.rs b/drivers/gpu/nova-core/vbios.rs index 7bec81a37340..180928433766 100644 --- a/drivers/gpu/nova-core/vbios.rs +++ b/drivers/gpu/nova-core/vbios.rs @@ -238,8 +238,8 @@ fn read_bios_image_at_offset( len: usize, context: &str, ) -> Result { - let data_len = self.data.len(); - if offset + len > data_len { + let end = offset.checked_add(len).ok_or(EINVAL)?; + if end > self.data.len() { self.read_more_at_offset(offset, len).inspect_err(|e| { dev_err!( self.dev, @@ -250,7 +250,7 @@ fn read_bios_image_at_offset( })?; } - BiosImage::new(self.dev, &self.data[offset..offset + len]).inspect_err(|err| { + BiosImage::new(self.dev, &self.data[offset..end]).inspect_err(|err| { dev_err!( self.dev, "Failed to {} at offset {:#x}: {:?}\n",