Re: [PATCH 2/2] drm/xe/nvm: define survivabilty partition

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Enabling the survivability region causes an infinite loop during erase operations at the 8MB boundary, and bypasses bounds checks via integer underflow on reads and writes.
--

--- Patch [2]: [PATCH 2/2] drm/xe/nvm: define survivabilty partition ---
commit b38b020b9c762ee5ac9265db46b43fe2139de54d
Author: Alexander Usyskin <alexander.usyskin@intel.com>

drm/xe/nvm: define survivabilty partition
    
Define 8M survivability partition for CRI when
storage is open for write.

> diff --git a/drivers/gpu/drm/xe/xe_nvm.c b/drivers/gpu/drm/xe/xe_nvm.c
> index 1ea67eaeae243..54de0dbe1fa4d 100644
> --- a/drivers/gpu/drm/xe/xe_nvm.c
> +++ b/drivers/gpu/drm/xe/xe_nvm.c
[ ... ]
> @@ -67,6 +68,7 @@ static bool xe_nvm_writable_override(struct xe_device *xe)
>  		reg = PCODE_SCRATCH(0);
>  		test_bit = FDO_MODE;
>  		test_val = FDO_MODE;
> +		s_size = SZ_8M;

[Severity: High]
Does enabling this survivability region cause an infinite loop during erase
operations in the MTD driver?

When this patch sets the size to 8MB and survivability is enabled, all
accesses are forced to use region 0, which has a hardcoded size of 8MB:

drivers/mtd/devices/mtd_intel_dg.c:idg_nvm_get_region() {
    ...
	if (nvm->survivability_enabled)
		return 0;
    ...
}

If a user performs an erase operation at or crossing the 8MB boundary, it can
trigger an infinite loop in intel_dg_mtd_erase():

drivers/mtd/devices/mtd_intel_dg.c:intel_dg_mtd_erase() {
    ...
	if (len > nvm->regions[idx].size - from)
		len = nvm->regions[idx].size - from;
    ...
}

When from reaches 8MB (the size of region 0), size - from evaluates to 0. This
sets len to 0. This can cause the operation to return 0 immediately without
decreasing total_len, leading to an infinite while (total_len > 0) loop.

Additionally, read and write operations starting beyond 8MB might cause
size - from to underflow to a massive positive number, bypassing bounds checks.

>  		break;
>  	case XE_BATTLEMAGE:
>  		reg = HECI_FWSTS2(DG2_GSC_HECI2_BASE);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260715-cri_surviv-v1-0-61763a6f1076@intel.com?part=2