Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Unchecked subtractions during framebuffer layout calculation can underflow if the hardware reports a small framebuffer size, causing a kernel panic or out-of-bounds memory calculations. -- --- Patch [3]: [PATCH v4 3/5] gpu: nova-core: return non-WPR heap size as u64 from HALs --- commit cfb0bee1c128905c124d8b00afa2860ab971ac23 Author: Eliot Courtney <[email protected]> gpu: nova-core: return non-WPR heap size as u64 from HALs This patch updates the HALs to return the non-WPR heap size as a u64 to avoid an immediate cast. > diff --git a/drivers/gpu/nova-core/fb.rs b/drivers/gpu/nova-core/fb.rs > index 4a1be29cf5fbd..86d2bdaab7f95 100644 > --- a/drivers/gpu/nova-core/fb.rs > +++ b/drivers/gpu/nova-core/fb.rs > @@ -271,7 +271,7 @@ pub(crate) fn new( > }; > > let non_wpr_heap = { > - let non_wpr_heap_size = u64::from(hal.non_wpr_heap_size()); > + let non_wpr_heap_size = hal.non_wpr_heap_size(); > FbRange(wpr2.start - non_wpr_heap_size..wpr2.start) [Severity: High] This isn't a bug introduced by this patch, but can this subtraction underflow if the hardware reports an unexpectedly small framebuffer size? Looking at FbLayout::new() in drivers/gpu/nova-core/fb.rs, there are multiple places where sizes are subtracted from addresses without using checked_sub(), such as: let base = fb.end - NV_PRAMIN_SIZE; ... let frts_base = vga_workspace.start.align_down(FRTS_DOWN_ALIGN) - frts_size; ... let bootloader_base = (frts.start - bootloader_size).align_down(BOOTLOADER_DOWN_ALIGN); ... let elf_addr = (boot.start - elf_size).align_down(ELF_DOWN_ALIGN); ... let wpr2_addr = (wpr2_heap.start - u64::from_safe_cast(size_of::<gsp::GspFwWprMeta>())) Could these calculations trigger a kernel panic (with overflow checks enabled) or result in out-of-bounds memory calculations if a small hardware-provided size is used during initialization? > }; > -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
