[PATCH v2 27/31] gpu: nova-core: gsp: validate RPC element framing on receive

[John Hubbard]

The r000 firmware gives RPC and GMC queue elements the same MCTP and
NVDM transport headers, and the driver advances the read pointer by the
element length those headers declare.

The RPC receive path checked only the MCTP magic, and only after it had
already sliced the payload using a length from the same unchecked
header. Nothing bounded the element length that advances the read
pointer, so a corrupt one moved the pointer to an arbitrary slot.

Run the RPC path through the same framing validation the GMC path uses,
before any length field is read.

Assisted-by: Cursor:claude-opus-5
Signed-off-by: John Hubbard <jhubbard@xxxxxxxxxx>
---
 drivers/gpu/nova-core/gsp/cmdq.rs | 22 ++++++++++++----------
 drivers/gpu/nova-core/gsp/fw.rs   | 17 ++++++++++++++---
 2 files changed, 26 insertions(+), 13 deletions(-)

diff --git a/drivers/gpu/nova-core/gsp/cmdq.rs b/drivers/gpu/nova-core/gsp/cmdq.rs
index 7a25ab936db9..fb7f000a5a7d 100644
--- a/drivers/gpu/nova-core/gsp/cmdq.rs
+++ b/drivers/gpu/nova-core/gsp/cmdq.rs
@@ -946,6 +946,18 @@ fn wait_for_msg(&self, bar: Bar0<'_>, timeout: Delta) -> Result<GspMessage<'_>>
             return Err(EIO);
         };
 
+        // Checked before any length field is read, since bad framing leaves them untrusted.
+        if let Err(e) = header.validate_framing() {
+            dev_err!(
+                &self.dev,
+                "GSP RPC: receive: Call {} - bad MCTP framing, declared length {}\n",
+                header.sequence(),
+                header.length(),
+            );
+            self.poisoned.set(true);
+            return Err(e);
+        }
+
         let payload_length = header.payload_length();
 
         // Check that the driver read area is large enough for the message.
@@ -967,16 +979,6 @@ fn wait_for_msg(&self, bar: Bar0<'_>, timeout: Delta) -> Result<GspMessage<'_>>
             )
         };
 
-        if !header.has_valid_magic() {
-            dev_err!(
-                &self.dev,
-                "GSP RPC: receive: Call {} - bad MCTP magic\n",
-                header.sequence()
-            );
-            self.poisoned.set(true);
-            return Err(EIO);
-        }
-
         Ok(GspMessage {
             header,
             contents: (slice_1, slice_2),
diff --git a/drivers/gpu/nova-core/gsp/fw.rs b/drivers/gpu/nova-core/gsp/fw.rs
index fe06da85fd43..53681b2267c0 100644
--- a/drivers/gpu/nova-core/gsp/fw.rs
+++ b/drivers/gpu/nova-core/gsp/fw.rs
@@ -574,9 +574,20 @@ pub(crate) fn length(&self) -> usize {
         num::u32_as_usize(self.mctp_payload_size)
     }
 
-    /// Returns `true` if the MCTP magic field contains the expected value.
-    pub(crate) fn has_valid_magic(&self) -> bool {
-        self.mctp_magic == MCTP_MAGIC
+    /// Validates the transport framing, before any length field in the element is trusted.
+    ///
+    /// # Errors
+    ///
+    /// - `EIO` if the MCTP magic, the MCTP version, the NVDM vendor id, or the declared element
+    ///   length is not one this driver accepts.
+    pub(crate) fn validate_framing(&self) -> Result {
+        validate_mctp_framing(
+            self.mctp_magic,
+            self.mctp_payload_size,
+            self.mctp_header,
+            self.nvdm_header,
+            size_of::<Self>(),
+        )
     }
 
     // Returns the sequence number of the message.
-- 
2.55.0