[PATCH] drm/nouveau/bios: fix u32 overflow in nvbios_addr() bounds check

[Noah Weinberger]

Hello,

The central nvbios bounds check overflows in u32:

    if (unlikely(*addr + size > bios->size))
        return false;

*addr can legitimately approach 2^32 after the image0/imaged
remapping earlier in the function (which adds bios->imaged_addr to
the caller's address), so *addr + size can wrap and pass the check;
&bios->data[addr] is then a wild pointer about 4 GB past the mapping.
Every VBIOS table access (nvbios_rd08/16/32, nvbios_pointer) goes
through this helper. The patch rewrites the check in the
overflow-free form.

Affected version/commit: mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08), drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c:36-46 (nvbios_addr: if (unlikely(*addr + size > bios->size)) with u32 *addr and u32 size), :52-78 (nvbios_pointer/nvbios_rd08/16/32 route every table access through it), consumers e.g. perf.c:38, vmap.c:36
Longstanding check.

This was found during an assisted (AI-supported) static source review of
mainline 8a65162514fbad21a2c58ffed65f42b27e92b163 (v7.4-rc2 window, 2026-11-08). The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

---
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
index fd3192df45..20735fba4a 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c
@@ -38,7 +38,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 *addr, u8 size)
 		*addr += bios->imaged_addr;
 	}
 
-	if (unlikely(*addr + size > bios->size)) {
+	if (unlikely(size > bios->size || *addr > bios->size - size)) {
 		nvkm_error(&bios->subdev, "OOB %d %08x %08x\n", size, p, *addr);
 		return false;
 	}