From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [linux-next:master 11967/15183] drivers/gpu/drm/amd/amdgpu/../ras/core/cmd.c:336 ras_cmd_get_batch_trace_records() error: buffer overflow 'output_data->records' 300 <= 2147483646
Date: Sat, 15 Aug 2026 19:24:33 +0800 [thread overview]
Message-ID: <202608151946.qh0Qq1AX-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: YiPeng Chai <YiPeng.Chai@amd.com>
CC: Alex Deucher <alexander.deucher@amd.com>
CC: Hawking Zhang <Hawking.Zhang@amd.com>
Hi YiPeng,
First bad commit (maybe != root cause):
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: 2697ef8943c9985c14708a6429e21812693857b2
commit: d95700604fbc6fd7534303796d005e6efbd1d591 [11967/15183] drm/amd/ras: rename core ras_* files and update include guards
:::::: branch date: 2 days ago
:::::: commit date: 9 days ago
config: x86_64-randconfig-161-20260810 (https://download.01.org/0day-ci/archive/20260815/202608151946.qh0Qq1AX-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202608151946.qh0Qq1AX-lkp@intel.com/
smatch warnings:
drivers/gpu/drm/amd/amdgpu/../ras/core/cmd.c:336 ras_cmd_get_batch_trace_records() error: buffer overflow 'output_data->records' 300 <= 2147483646
vim +336 drivers/gpu/drm/amd/amdgpu/../ras/core/cmd.c
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 291
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 292 static int ras_cmd_get_batch_trace_records(struct ras_core_context *ras_core,
4c74635afdceff drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-09-25 293 struct ras_cmd_ctx *cmd, void *data)
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 294 {
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 295 struct ras_cmd_batch_trace_record_req *input_data =
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 296 (struct ras_cmd_batch_trace_record_req *)cmd->input_buff_raw;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 297 struct ras_cmd_batch_trace_record_rsp *output_data =
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 298 (struct ras_cmd_batch_trace_record_rsp *)cmd->output_buff_raw;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 299 struct ras_log_batch_overview overview;
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 300 struct ras_log_info *trace_arry = NULL;
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 301 uint32_t trace_count = MAX_RECORD_PER_BATCH;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 302 struct ras_log_info *record;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 303 int i, j, count = 0, offset = 0;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 304 uint64_t id;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 305 bool completed = false;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 306
2206e6c76d05e3 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 307 if ((cmd->input_size != sizeof(struct ras_cmd_batch_trace_record_req)) ||
2206e6c76d05e3 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 308 (cmd->output_buf_size < sizeof(*output_data)))
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 309 return RAS_CMD__ERROR_INVALID_INPUT_SIZE;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 310
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 311 if ((!input_data->batch_num) || (input_data->batch_num > RAS_CMD_MAX_BATCH_NUM))
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 312 return RAS_CMD__ERROR_INVALID_INPUT_DATA;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 313
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 314 ras_log_ring_get_batch_overview(ras_core, &overview);
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 315 if ((input_data->start_batch_id < overview.first_batch_id) ||
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 316 (input_data->start_batch_id >= overview.last_batch_id))
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 317 return RAS_CMD__ERROR_INVALID_INPUT_SIZE;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 318
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 319 trace_arry = kcalloc(trace_count, sizeof(*trace_arry), GFP_KERNEL);
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 320 if (!trace_arry)
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 321 return RAS_CMD__ERROR_GENERIC;
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 322
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 323 for (i = 0; i < input_data->batch_num; i++) {
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 324 id = input_data->start_batch_id + i;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 325 if (id >= overview.last_batch_id) {
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 326 completed = true;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 327 break;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 328 }
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 329
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 330 count = ras_log_ring_get_batch_records(ras_core,
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 331 id, trace_arry, trace_count);
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 332 if (count > 0) {
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 333 if ((offset + count) > RAS_CMD_MAX_TRACE_NUM)
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 334 break;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 335 for (j = 0; j < count; j++) {
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 @336 record = &output_data->records[offset + j];
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 337 record->seqno = trace_arry[j].seqno;
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 338 record->timestamp = trace_arry[j].timestamp;
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 339 record->event = trace_arry[j].event;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 340 memcpy(&record->aca_reg,
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 341 &trace_arry[j].aca_reg, sizeof(trace_arry[j].aca_reg));
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 342 }
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 343 } else {
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 344 count = 0;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 345 }
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 346
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 347 output_data->batchs[i].batch_id = id;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 348 output_data->batchs[i].offset = offset;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 349 output_data->batchs[i].trace_num = count;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 350 offset += count;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 351 }
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 352
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 353 output_data->start_batch_id = input_data->start_batch_id;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 354 output_data->real_batch_num = i;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 355 output_data->remain_num = completed ? 0 : (input_data->batch_num - i);
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 356 output_data->version = 0;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 357
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 358 cmd->output_size = sizeof(struct ras_cmd_batch_trace_record_rsp);
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 359
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 360 kfree(trace_arry);
90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 361
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 362 return RAS_CMD__SUCCESS;
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 363 }
19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 364
:::::: The code at line 336 was first introduced by commit
:::::: 19030244e1f99f3e9f8617ba4cb90ce49276eab0 drm/amd/ras: Add ras ioctl command handler
:::::: TO: YiPeng Chai <YiPeng.Chai@amd.com>
:::::: CC: Alex Deucher <alexander.deucher@amd.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-08-15 11:25 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202608151946.qh0Qq1AX-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.