Re: [PATCH 3/3] drm/xe/hwmon: Correct group selection for memory controller temperature

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Out-of-bounds write of 1 byte into `hwmon->temp.value` when reading thermal data from pcode if the sensor count exceeds 252.
--

--- Patch [3]: [PATCH 3/3] drm/xe/hwmon: Correct group selection for memory controller temperature ---
commit d6bd40537c53d76ef6df15e33458ad0d982f56b1
Author: Karthik Poosa <karthik.poosa@intel.com>

drm/xe/hwmon: Correct group selection for memory controller temperature
    
This patch corrects the memory controller temperature group selection by
updating get_mc_temp() to read all necessary groups based on the actual
sensor count rather than a hardcoded maximum.

> diff --git a/drivers/gpu/drm/xe/xe_hwmon.c b/drivers/gpu/drm/xe/xe_hwmon.c
> --- a/drivers/gpu/drm/xe/xe_hwmon.c
> +++ b/drivers/gpu/drm/xe/xe_hwmon.c

[ ... ]

> @@ -820,7 +820,7 @@ static int get_mc_temp(struct xe_hwmon *hwmon, long *val)
>  	int ret, i, count = 0;
>  	s32 average = 0;
>  
> -	for (i = 0; i < DIV_ROUND_UP(TEMP_LIMIT_MAX, sizeof(u32)); i++) {
> +	for (i = 0; i < DIV_ROUND_UP(hwmon->temp.count, sizeof(u32)); i++) {

[Severity: Medium]
Could this lead to an out-of-bounds write into hwmon->temp.value if the
hardware returns a sensor count greater than 252?

If hwmon->temp.count is between 253 and 255, the DIV_ROUND_UP calculation
evaluates to 64. The loop will execute 64 times, reading 4 bytes per
iteration, resulting in 256 bytes being written to the dword pointer.

Since dword points to hwmon->temp.value, which is sized at 255 bytes, this
will write past the end of the array by 1 byte.

>  		ret = xe_pcode_read(root_tile, PCODE_MBOX(PCODE_THERMAL_INFO, READ_THERMAL_DATA, i),
>  				    (dword + i), NULL);
>  		if (ret)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824184137.2164727-1-karthik.poosa@intel.com?part=3