* Re: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
2026-07-08 6:18 ` [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast Pavitra Jha
@ 2026-07-08 6:30 ` sashiko-bot
2026-07-08 14:54 ` Alex Deucher
` (2 subsequent siblings)
3 siblings, 0 replies; 8+ messages in thread
From: sashiko-bot @ 2026-07-08 6:30 UTC (permalink / raw)
To: Pavitra Jha; +Cc: dri-devel
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
New issues:
- [Low] Misapplied patch hunk causes compilation errors.
Pre-existing issues:
- [High] The intended security fix is completely missing from `amdgpu_discovery_get_table_info`, leaving out-of-bounds reads unpatched.
- [High] The newly added offset validation only checks the start offset, failing to verify that the structure fits within the buffer.
- [High] Missing validation for downstream table sizes and internal offsets causes out-of-bounds reads during parsing and checksum verification.
- [High] Direct array access for IP_DISCOVERY table offsets breaks for version 2 binaries.
--
--- Patch [1]: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast ---
commit 9aac939f5a3fe8366dddb94f326456646c35f228
Author: Pavitra Jha <jhapavitra98@gmail.com>
drm/amdgpu/discovery: validate table offset before IP discovery header cast
The commit intends to validate the firmware-controlled table offset before
casting it to the IP discovery header to prevent out-of-bounds reads. It
aims to add offset checks in both the common parsing path and direct access
sites.
> Fix by validating the table offset in amdgpu_discovery_get_table_info(),
> which is the common path used by all callers except
> amdgpu_discovery_read_harvest_bit_per_ip() (which reads
[Severity: High]
This isn't a bug introduced by this patch, but the commit message states the
fix is added to amdgpu_discovery_get_table_info(), while the diff actually
applies the validation hunk to amdgpu_discovery_verify_npsinfo() instead.
Since amdgpu_discovery_get_table_info() remains unpatched, doesn't this leave
the shared table parsing paths vulnerable to out-of-bounds reads when parsing
firmware data?
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> index a015d55aa158e..07544bcfaf2ef 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> @@ -531,6 +531,12 @@ static int amdgpu_discovery_verify_npsinfo(struct amdgpu_device *adev,
> return -EINVAL;
> }
>
> + if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
> + dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
> + le16_to_cpu((*info)->offset), table_id);
> + return -EINVAL;
> + }
> +
[Severity: Low]
Does this compile?
In amdgpu_discovery_verify_npsinfo(), info is a single pointer of type struct
table_info *info, making (*info)->offset invalid C syntax. Additionally,
table_id is undeclared in this function. It appears this hunk was intended
for amdgpu_discovery_get_table_info() but was misapplied here.
[ ... ]
> @@ -803,6 +809,14 @@ static void amdgpu_discovery_read_harvest_bit_per_ip(struct amdgpu_device *adev,
> int i, j;
>
> bhdr = (struct binary_header *)discovery_bin;
[Severity: High]
This is a pre-existing issue, but does unconditionally casting to
struct binary_header * work for version 2 binaries?
Since version 2 binaries (struct binary_header_v2) insert num_tables and
padding before the table_list array, wouldn't accessing
bhdr->table_list[IP_DISCOVERY].offset read from those fields instead,
leading to incorrect offset calculations and out-of-bounds accesses?
> +
> + if (le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset) >=
> + adev->discovery.size) {
[Severity: High]
This is a pre-existing issue, but does this check adequately prevent
out-of-bounds reads?
The check only verifies that the start offset is within the buffer bounds. If
an offset is placed at the very end of the buffer, wouldn't the subsequent
read of ihdr->num_dies access memory beyond the buffer since the structure
size is not validated?
> + dev_err(adev->dev, "invalid IP_DISCOVERY table offset %u\n",
> + le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
> + return;
> + }
> +
> ihdr = (struct ip_discovery_header
> *)(discovery_bin +
> le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
[Severity: High]
This is a pre-existing issue, but are downstream table sizes and internal
offsets validated to prevent out-of-bounds reads?
For example, in amdgpu_discovery_read_harvest_bit_per_ip(), ip_offset is
declared as a uint16_t:
ip_offset += struct_size(ip, base_address,
ip->num_base_address);
Could a struct_size() overflow result in SIZE_MAX being truncated to a
smaller value by uint16_t, thereby defeating built-in overflow protections?
Additionally, in amdgpu_discovery_init(), is it possible for the size
calculation to underflow?
size = le16_to_cpu(bhdr->binary_size) - offset;
If binary_size is less than offset, this underflow could lead to a large
out-of-bounds read in the checksum verification loop.
Similarly, in amdgpu_discovery_table_check(), table_size is read from headers
and passed directly to amdgpu_discovery_verify_checksum(). Is there a check
to ensure it fits within the buffer?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260708061835.111986-1-jhapavitra98@gmail.com?part=1
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
2026-07-08 6:18 ` [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast Pavitra Jha
2026-07-08 6:30 ` sashiko-bot
@ 2026-07-08 14:54 ` Alex Deucher
2026-07-08 15:35 ` Pavitra Jha
2026-08-12 9:03 ` kernel test robot
2026-08-12 20:46 ` kernel test robot
3 siblings, 1 reply; 8+ messages in thread
From: Alex Deucher @ 2026-07-08 14:54 UTC (permalink / raw)
To: Pavitra Jha
Cc: alexander.deucher, christian.koenig, airlied, simona, amd-gfx,
dri-devel, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 3685 bytes --]
On Wed, Jul 8, 2026 at 9:19 AM Pavitra Jha <jhapavitra98@gmail.com> wrote:
>
> Sashiko AI review of the previous fix flagged three remaining gaps in
> the discovery blob parser, all stemming from the same root cause: the
> ip_discovery_header pointer itself is constructed from a firmware-
> controlled offset with no validation before the cast.
>
> ihdr = (struct ip_discovery_header *)(discovery_bin +
> le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
>
> This offset is a firmware-controlled u16 read directly from the
> discovery blob's table_list, with no bounds check against
> adev->discovery.size before being used to construct ihdr. Every
> subsequent read from ihdr, including num_dies and die_info[], is
> downstream of this unchecked pointer.
>
> The other two items in that review (unbounded ip_offset advancement
> via num_base_address, and num_dies exceeding die_info[]'s capacity)
> were already addressed in the previous fix.
>
> Fix by validating the table offset in amdgpu_discovery_get_table_info(),
> which is the common path used by all callers except
> amdgpu_discovery_read_harvest_bit_per_ip() (which reads
> table_list[IP_DISCOVERY].offset directly rather than going through
> get_table_info()). Add the equivalent check at that direct access site
> as well, so all paths that construct an ip_discovery_header pointer
> from a table offset are covered.
>
> The check validates the offset itself against adev->discovery.size,
> independent of any specific downstream struct size, since
> get_table_info() is shared across ten different table types
> (IP_DISCOVERY, HARVEST_INFO, GC, MALL_INFO, VCN_INFO, NPS_INFO, and
> others) each with differently-sized table structures.
>
> Fixes: d0c647a6aae2 ("drm/amdgpu/discovery: support new discovery binary header")
> Cc: stable@vger.kernel.org
> Signed-off-by: Pavitra Jha <jhapavitra98@gmail.com>
This patch no longer applies to the current drm-next code. I've fixed
it up and attached it here. It was a relatively large change so I
want to make sure you are ok with it if I keep your authorship.
Thanks!
Alex
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> index b4ee5fc8e..9b55c56cb 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> @@ -564,6 +564,12 @@ static int amdgpu_discovery_get_table_info(struct amdgpu_device *adev,
> return -EINVAL;
> }
>
> + if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
> + dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
> + le16_to_cpu((*info)->offset), table_id);
> + return -EINVAL;
> + }
> +
> return 0;
> }
>
> @@ -766,6 +772,14 @@ static void amdgpu_discovery_read_harvest_bit_per_ip(struct amdgpu_device *adev,
> int i, j;
>
> bhdr = (struct binary_header *)discovery_bin;
> +
> + if (le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset) >=
> + adev->discovery.size) {
> + dev_err(adev->dev, "invalid IP_DISCOVERY table offset %u\n",
> + le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
> + return;
> + }
> +
> ihdr = (struct ip_discovery_header
> *)(discovery_bin +
> le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
> --
> 2.53.0
>
[-- Attachment #2: 0001-drm-amdgpu-discovery-validate-table-offset-before-IP.patch --]
[-- Type: text/x-patch, Size: 4804 bytes --]
From 4bebdc2f6911d5e114b6da58276884ded594ca61 Mon Sep 17 00:00:00 2001
From: Pavitra Jha <jhapavitra98@gmail.com>
Date: Wed, 8 Jul 2026 02:18:34 -0400
Subject: [PATCH] drm/amdgpu/discovery: validate table offset before IP
discovery header cast
Sashiko AI review of the previous fix flagged three remaining gaps in
the discovery blob parser, all stemming from the same root cause: the
ip_discovery_header pointer itself is constructed from a firmware-
controlled offset with no validation before the cast.
ihdr = (struct ip_discovery_header *)(discovery_bin +
le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
This offset is a firmware-controlled u16 read directly from the
discovery blob's table_list, with no bounds check against
adev->discovery.size before being used to construct ihdr. Every
subsequent read from ihdr, including num_dies and die_info[], is
downstream of this unchecked pointer.
The other two items in that review (unbounded ip_offset advancement
via num_base_address, and num_dies exceeding die_info[]'s capacity)
were already addressed in the previous fix.
Fix by validating the table offset in amdgpu_discovery_get_table_info(),
which is the common path used by all callers except
amdgpu_discovery_read_harvest_bit_per_ip() (which reads
table_list[IP_DISCOVERY].offset directly rather than going through
get_table_info()). Add the equivalent check at that direct access site
as well, so all paths that construct an ip_discovery_header pointer
from a table offset are covered.
The check validates the offset itself against adev->discovery.size,
independent of any specific downstream struct size, since
get_table_info() is shared across ten different table types
(IP_DISCOVERY, HARVEST_INFO, GC, MALL_INFO, VCN_INFO, NPS_INFO, and
others) each with differently-sized table structures.
v2: rebase on latest code (Alex)
Fixes: d0c647a6aae2 ("drm/amdgpu/discovery: support new discovery binary header")
Signed-off-by: Pavitra Jha <jhapavitra98@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 31 ++++++++++++++++---
1 file changed, 26 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index f33278fcc0f41..d565dd7abc6fa 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -566,22 +566,33 @@ static const char *amdgpu_discovery_get_fw_name(struct amdgpu_device *adev)
}
static struct table_info *
-amdgpu_discovery_get_table_info_from_bin(uint8_t *discovery_bin,
+amdgpu_discovery_get_table_info_from_bin(struct amdgpu_device *adev,
+ uint8_t *discovery_bin,
uint16_t table_id)
{
struct binary_header *bhdr = (struct binary_header *)discovery_bin;
struct binary_header_v2 *bhdrv2;
+ struct table_info *info;
switch (bhdr->version_major) {
case 2:
bhdrv2 = (struct binary_header_v2 *)discovery_bin;
- return &bhdrv2->table_list[table_id];
+ info = &bhdrv2->table_list[table_id];
+ break;
case 1:
case 0:
- return &bhdr->table_list[table_id];
+ info = &bhdr->table_list[table_id];
+ break;
default:
return NULL;
}
+
+ if (le16_to_cpu((info)->offset) >= adev->discovery.size) {
+ dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
+ le16_to_cpu((info)->offset), table_id);
+ return NULL;
+ }
+ return info;
}
static int amdgpu_discovery_get_table_info(struct amdgpu_device *adev,
@@ -591,7 +602,8 @@ static int amdgpu_discovery_get_table_info(struct amdgpu_device *adev,
struct binary_header *bhdr =
(struct binary_header *)adev->discovery.bin;
- *info = amdgpu_discovery_get_table_info_from_bin(adev->discovery.bin,
+ *info = amdgpu_discovery_get_table_info_from_bin(adev,
+ adev->discovery.bin,
table_id);
if (!*info) {
dev_err(adev->dev, "Invalid ip discovery table version %d\n",
@@ -803,6 +815,14 @@ static void amdgpu_discovery_read_harvest_bit_per_ip(struct amdgpu_device *adev,
int i, j;
bhdr = (struct binary_header *)discovery_bin;
+
+ if (le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset) >=
+ adev->discovery.size) {
+ dev_err(adev->dev, "invalid IP_DISCOVERY table offset %u\n",
+ le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
+ return;
+ }
+
ihdr = (struct ip_discovery_header
*)(discovery_bin +
le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
@@ -1329,7 +1349,8 @@ static int amdgpu_discovery_sysfs_recurse(struct amdgpu_device *adev,
size_t ip_offset;
int ii, res;
- info = amdgpu_discovery_get_table_info_from_bin(discovery_bin,
+ info = amdgpu_discovery_get_table_info_from_bin(adev,
+ discovery_bin,
IP_DISCOVERY);
if (!info)
return -EINVAL;
--
2.55.0
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
2026-07-08 14:54 ` Alex Deucher
@ 2026-07-08 15:35 ` Pavitra Jha
0 siblings, 0 replies; 8+ messages in thread
From: Pavitra Jha @ 2026-07-08 15:35 UTC (permalink / raw)
To: Alex Deucher
Cc: alexander.deucher, christian.koenig, airlied, simona, amd-gfx,
dri-devel, linux-kernel
Hi Alex,
Yes, absolutely! You can keep my authorship on the patch.
Thank you for fixing it up.
Best,
Pavitra Jha
On Wed, 8 Jul 2026 at 20:24, Alex Deucher <alexdeucher@gmail.com> wrote:
>
> On Wed, Jul 8, 2026 at 9:19 AM Pavitra Jha <jhapavitra98@gmail.com> wrote:
> >
> > Sashiko AI review of the previous fix flagged three remaining gaps in
> > the discovery blob parser, all stemming from the same root cause: the
> > ip_discovery_header pointer itself is constructed from a firmware-
> > controlled offset with no validation before the cast.
> >
> > ihdr = (struct ip_discovery_header *)(discovery_bin +
> > le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
> >
> > This offset is a firmware-controlled u16 read directly from the
> > discovery blob's table_list, with no bounds check against
> > adev->discovery.size before being used to construct ihdr. Every
> > subsequent read from ihdr, including num_dies and die_info[], is
> > downstream of this unchecked pointer.
> >
> > The other two items in that review (unbounded ip_offset advancement
> > via num_base_address, and num_dies exceeding die_info[]'s capacity)
> > were already addressed in the previous fix.
> >
> > Fix by validating the table offset in amdgpu_discovery_get_table_info(),
> > which is the common path used by all callers except
> > amdgpu_discovery_read_harvest_bit_per_ip() (which reads
> > table_list[IP_DISCOVERY].offset directly rather than going through
> > get_table_info()). Add the equivalent check at that direct access site
> > as well, so all paths that construct an ip_discovery_header pointer
> > from a table offset are covered.
> >
> > The check validates the offset itself against adev->discovery.size,
> > independent of any specific downstream struct size, since
> > get_table_info() is shared across ten different table types
> > (IP_DISCOVERY, HARVEST_INFO, GC, MALL_INFO, VCN_INFO, NPS_INFO, and
> > others) each with differently-sized table structures.
> >
> > Fixes: d0c647a6aae2 ("drm/amdgpu/discovery: support new discovery binary header")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Pavitra Jha <jhapavitra98@gmail.com>
>
> This patch no longer applies to the current drm-next code. I've fixed
> it up and attached it here. It was a relatively large change so I
> want to make sure you are ok with it if I keep your authorship.
>
> Thanks!
>
> Alex
>
> > ---
> > drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 14 ++++++++++++++
> > 1 file changed, 14 insertions(+)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> > index b4ee5fc8e..9b55c56cb 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> > @@ -564,6 +564,12 @@ static int amdgpu_discovery_get_table_info(struct amdgpu_device *adev,
> > return -EINVAL;
> > }
> >
> > + if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
> > + dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
> > + le16_to_cpu((*info)->offset), table_id);
> > + return -EINVAL;
> > + }
> > +
> > return 0;
> > }
> >
> > @@ -766,6 +772,14 @@ static void amdgpu_discovery_read_harvest_bit_per_ip(struct amdgpu_device *adev,
> > int i, j;
> >
> > bhdr = (struct binary_header *)discovery_bin;
> > +
> > + if (le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset) >=
> > + adev->discovery.size) {
> > + dev_err(adev->dev, "invalid IP_DISCOVERY table offset %u\n",
> > + le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
> > + return;
> > + }
> > +
> > ihdr = (struct ip_discovery_header
> > *)(discovery_bin +
> > le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
> > --
> > 2.53.0
> >
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
2026-07-08 6:18 ` [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast Pavitra Jha
2026-07-08 6:30 ` sashiko-bot
2026-07-08 14:54 ` Alex Deucher
@ 2026-08-12 9:03 ` kernel test robot
2026-08-12 20:46 ` kernel test robot
3 siblings, 0 replies; 8+ messages in thread
From: kernel test robot @ 2026-08-12 9:03 UTC (permalink / raw)
To: Pavitra Jha, alexander.deucher, christian.koenig, airlied, simona
Cc: oe-kbuild-all, amd-gfx, dri-devel, linux-kernel, stable,
Pavitra Jha
Hi Pavitra,
kernel test robot noticed the following build errors:
[auto build test ERROR on drm-misc/drm-misc-next]
[also build test ERROR on linus/master v7.2-rc7 next-20260810]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Pavitra-Jha/drm-amdgpu-discovery-validate-table-offset-before-IP-discovery-header-cast/20260812-100224
base: https://gitlab.freedesktop.org/drm/misc/kernel.git drm-misc-next
patch link: https://lore.kernel.org/r/20260708061835.111986-1-jhapavitra98%40gmail.com
patch subject: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
config: alpha-allyesconfig (https://download.01.org/0day-ci/archive/20260812/202608121611.JGbGRW2o-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260812/202608121611.JGbGRW2o-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608121611.JGbGRW2o-lkp@intel.com/
All errors (new ones prefixed by >>):
In file included from include/linux/byteorder/little_endian.h:5,
from arch/alpha/include/uapi/asm/byteorder.h:5,
from include/asm-generic/bitops/le.h:6,
from arch/alpha/include/asm/bitops.h:472,
from include/linux/bitops.h:67,
from include/linux/thread_info.h:27,
from include/asm-generic/preempt.h:5,
from ./arch/alpha/include/generated/asm/preempt.h:1,
from include/linux/preempt.h:79,
from include/linux/spinlock.h:56,
from include/linux/mmzone.h:8,
from include/linux/gfp.h:7,
from include/linux/firmware.h:8,
from drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:24:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c: In function 'amdgpu_discovery_verify_npsinfo':
>> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:534:32: error: invalid type argument of '->' (have 'struct table_info')
534 | if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
| ^~
include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu'
37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:534:13: note: in expansion of macro 'le16_to_cpu'
534 | if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
| ^~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:536:44: error: invalid type argument of '->' (have 'struct table_info')
536 | le16_to_cpu((*info)->offset), table_id);
| ^~
include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu'
37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
| ^
include/linux/dev_printk.h:154:9: note: in expansion of macro 'dev_printk_index_wrap'
154 | dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:535:17: note: in expansion of macro 'dev_err'
535 | dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
| ^~~~~~~
In file included from include/linux/device.h:15,
from include/drm/drm_print.h:31,
from drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h:29,
from drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.h:30,
from drivers/gpu/drm/amd/amdgpu/amdgpu.h:37,
from drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:27:
>> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:536:55: error: 'table_id' undeclared (first use in this function); did you mean 'table_info'?
536 | le16_to_cpu((*info)->offset), table_id);
| ^~~~~~~~
include/linux/dev_printk.h:110:37: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:535:17: note: in expansion of macro 'dev_err'
535 | dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
| ^~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:536:55: note: each undeclared identifier is reported only once for each function it appears in
include/linux/dev_printk.h:110:37: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:535:17: note: in expansion of macro 'dev_err'
535 | dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
| ^~~~~~~
vim +534 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
508
509 static int amdgpu_discovery_verify_npsinfo(struct amdgpu_device *adev,
510 struct table_info *info)
511 {
512 uint8_t *discovery_bin = adev->discovery.bin;
513 uint16_t checksum;
514 uint16_t offset;
515
516 offset = le16_to_cpu(info->offset);
517 checksum = le16_to_cpu(info->checksum);
518
519 struct nps_info_header *nhdr =
520 (struct nps_info_header *)(discovery_bin + offset);
521
522 if (le32_to_cpu(nhdr->table_id) != NPS_INFO_TABLE_ID) {
523 dev_dbg(adev->dev, "invalid ip discovery nps info table id\n");
524 return -EINVAL;
525 }
526
527 if (!amdgpu_discovery_verify_checksum(adev, discovery_bin + offset,
528 le32_to_cpu(nhdr->size_bytes),
529 checksum)) {
530 dev_dbg(adev->dev, "invalid nps info data table checksum\n");
531 return -EINVAL;
532 }
533
> 534 if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
535 dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
> 536 le16_to_cpu((*info)->offset), table_id);
537 return -EINVAL;
538 }
539
540 return 0;
541 }
542
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
2026-07-08 6:18 ` [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast Pavitra Jha
` (2 preceding siblings ...)
2026-08-12 9:03 ` kernel test robot
@ 2026-08-12 20:46 ` kernel test robot
3 siblings, 0 replies; 8+ messages in thread
From: kernel test robot @ 2026-08-12 20:46 UTC (permalink / raw)
To: Pavitra Jha, alexander.deucher, christian.koenig, airlied, simona
Cc: llvm, oe-kbuild-all, amd-gfx, dri-devel, linux-kernel, stable,
Pavitra Jha
Hi Pavitra,
kernel test robot noticed the following build errors:
[auto build test ERROR on drm-misc/drm-misc-next]
[also build test ERROR on linus/master v7.2-rc7 next-20260811]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Pavitra-Jha/drm-amdgpu-discovery-validate-table-offset-before-IP-discovery-header-cast/20260812-100224
base: https://gitlab.freedesktop.org/drm/misc/kernel.git drm-misc-next
patch link: https://lore.kernel.org/r/20260708061835.111986-1-jhapavitra98%40gmail.com
patch subject: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20260813/202608130435.5Msck82Q-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 12df34b8469b8095359de8c249cb1b2753fadeea)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260813/202608130435.5Msck82Q-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608130435.5Msck82Q-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:534:25: error: member reference type 'struct table_info' is not a pointer; did you mean to use '.'?
534 | if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
| ~~~~~~~^~
| .
include/linux/byteorder/generic.h:91:21: note: expanded from macro 'le16_to_cpu'
91 | #define le16_to_cpu __le16_to_cpu
| ^
include/uapi/linux/byteorder/little_endian.h:37:51: note: expanded from macro '__le16_to_cpu'
37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:536:23: error: member reference type 'struct table_info' is not a pointer; did you mean to use '.'?
536 | le16_to_cpu((*info)->offset), table_id);
| ~~~~~~~^~
| .
include/linux/dev_printk.h:154:65: note: expanded from macro 'dev_err'
154 | dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
include/linux/dev_printk.h:110:23: note: expanded from macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~~~~~~~~~
include/uapi/linux/byteorder/little_endian.h:37:51: note: expanded from macro '__le16_to_cpu'
37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
| ^
>> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:536:34: error: use of undeclared identifier 'table_id'
536 | le16_to_cpu((*info)->offset), table_id);
| ^~~~~~~~
3 errors generated.
vim +534 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
508
509 static int amdgpu_discovery_verify_npsinfo(struct amdgpu_device *adev,
510 struct table_info *info)
511 {
512 uint8_t *discovery_bin = adev->discovery.bin;
513 uint16_t checksum;
514 uint16_t offset;
515
516 offset = le16_to_cpu(info->offset);
517 checksum = le16_to_cpu(info->checksum);
518
519 struct nps_info_header *nhdr =
520 (struct nps_info_header *)(discovery_bin + offset);
521
522 if (le32_to_cpu(nhdr->table_id) != NPS_INFO_TABLE_ID) {
523 dev_dbg(adev->dev, "invalid ip discovery nps info table id\n");
524 return -EINVAL;
525 }
526
527 if (!amdgpu_discovery_verify_checksum(adev, discovery_bin + offset,
528 le32_to_cpu(nhdr->size_bytes),
529 checksum)) {
530 dev_dbg(adev->dev, "invalid nps info data table checksum\n");
531 return -EINVAL;
532 }
533
> 534 if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
535 dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
> 536 le16_to_cpu((*info)->offset), table_id);
537 return -EINVAL;
538 }
539
540 return 0;
541 }
542
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 8+ messages in thread