On Mon Dec 15, 2025 at 8:29 AM JST, Alistair Popple wrote: > On 2025-12-12 at 18:59 +1100, Joel Fernandes <[email protected]> wrote... >> Hi Alex, >> >> > On Nov 22, 2025, at 12:00 AM, Alexandre Courbot <[email protected]> >> > wrote: >> > >> > The size of messages' payload is miscalculated, leading to extra data >> > passed to the message handler. While this is not a problem with our >> > current set of commands, others with a variable-length payload may >> > misbehave. Fix this. >> > >> > Signed-off-by: Alexandre Courbot <[email protected]> >> > --- >> > drivers/gpu/nova-core/gsp/cmdq.rs | 11 +++++++---- >> > drivers/gpu/nova-core/gsp/fw.rs | 2 +- >> > 2 files changed, 8 insertions(+), 5 deletions(-) >> > >> > diff --git a/drivers/gpu/nova-core/gsp/cmdq.rs >> > b/drivers/gpu/nova-core/gsp/cmdq.rs >> > index 6f946d14868a..dab73377c526 100644 >> > --- a/drivers/gpu/nova-core/gsp/cmdq.rs >> > +++ b/drivers/gpu/nova-core/gsp/cmdq.rs >> > @@ -588,21 +588,24 @@ fn wait_for_msg(&self, timeout: Delta) -> >> > Result<GspMessage<'_>> { >> > header.length(), >> > ); >> > >> > + // The length of the message that follows the header. >> > + let msg_length = header.length() - size_of::<GspMsgElement>(); > > Wouldn't it be better to add a new method to GspMsgElement to get the size of > the associated message rather than open coding it here?
Agreed, that seems to make sense and should provide us with a safe operation.
