Re: [PATCH v4 02/12] drm/xe/cper: Retrieve the error counter record for CPER reporting

["Nilawar, Badal" <badal.nilawar@intel.com>]

On 09-10-2026 16:16, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] drm/xe: out-of-bounds array access on informational or reserved RAS errors
> --
>
> commit 27317cc719f71d74be0f7fcd94c5a8fbf53f9e5e
> Author: Badal Nilawar <badal.nilawar@intel.com>
>
> drm/xe/cper: Retrieve the error counter record for CPER reporting
>      
> Retrieve error counter record required to build a CPER record.
>
>> diff --git a/drivers/gpu/drm/xe/xe_ras.c b/drivers/gpu/drm/xe/xe_ras.c
>> index 7a85735c57d58..5cfc9beff8c13 100644
>> --- a/drivers/gpu/drm/xe/xe_ras.c
>> +++ b/drivers/gpu/drm/xe/xe_ras.c
> [ ... ]
>> @@ -284,21 +282,21 @@ static void ras_send_error_event(struct xe_device *xe, u8 severity, u8 component)
>>   {
>>   	struct xe_ras_error_class counter = {0};
>> +	struct xe_ras_get_counter_response response = {0};
>>   	u8 drm_severity, drm_component;
>> -	u32 value;
>>   	int ret;
>>   
>>   	counter.common.severity = severity;
>>   	counter.common.component = component;
>>   
>> -	ret = get_counter(xe, &counter, &value);
>> +	ret = xe_ras_get_counter_response(xe, &counter, &response);
>>   	if (ret)
>>   		return;
>>   
>>   	drm_severity = xe_to_drm_ras_severity(severity);
>>   	drm_component = xe_to_drm_ras_component(component);
>>   
>> -	xe_drm_ras_event(xe, drm_component, drm_severity, value);
>> +	xe_drm_ras_event(xe, drm_component, drm_severity, response.value);
> [Severity: High]
> When firmware returns valid but unmapped values, like
> XE_RAS_SEV_INFORMATIONAL or XE_RAS_COMP_RESERVED, is it possible that
> xe_to_drm_ras_severity() and xe_to_drm_ras_component() will map these to
> their MAX values (DRM_XE_RAS_ERR_SEV_MAX and DRM_XE_RAS_ERR_COMP_MAX)?
>
> If so, does this call to xe_drm_ras_event() cause out-of-bounds array
> accesses?
>
> In drivers/gpu/drm/xe/xe_drm_ras.c:xe_drm_ras_event():
>
>      struct xe_drm_ras_counter *info = ras->info[severity];
>      ...
>      node = &ras->node[severity];
>
>      if (!info || !info[component].name)
>          return;
>
> Since the arrays are sized for the valid drm enum mappings, using the MAX
> values as indices would lead to wild pointer dereferences.

Good catch. This is pre-existing (from 6a9493e47075) and is not 
introduced by this series.

I'll send a separate fix that skips the drm_ras event when the severity 
or component has no drm mapping.

Thanks,
Badal

>
>>   }
>>   
>>   static u8 handle_core_compute_errors(struct xe_ras_error_array *arr)