Re: [PATCH v2 3/5] drm/xe/hwmon: Correct group selection for memory controller temperature

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unaligned memory access due to misaligned pointer cast.
--

commit bce6aebc01fe7736c7ce377f855345b461ab89e3
Author: Karthik Poosa <karthik.poosa@intel.com>

drm/xe/hwmon: Correct group selection for memory controller temperature
    
Read all the necessary groups when reading memory controller
temperature in get_mc_temp().

> diff --git a/drivers/gpu/drm/xe/xe_hwmon.c b/drivers/gpu/drm/xe/xe_hwmon.c
> index 51a6664eec485..3a675d7b6758b 100644
> --- a/drivers/gpu/drm/xe/xe_hwmon.c
> +++ b/drivers/gpu/drm/xe/xe_hwmon.c
[ ... ]
> @@ -883,7 +883,7 @@ static int get_mc_temp(struct xe_hwmon *hwmon, long *val)
>  	int ret, i, count = 0;
>  	s32 average = 0;
>  
> -	for (i = 0; i < DIV_ROUND_UP(TEMP_LIMIT_MAX, sizeof(u32)); i++) {
> +	for (i = 0; i < DIV_ROUND_UP(hwmon->temp.count, sizeof(u32)); i++) {
>  		ret = xe_pcode_read(root_tile, PCODE_MBOX(PCODE_THERMAL_INFO, READ_THERMAL_DATA, i),
>  				    (dword + i), NULL);

[Severity: High]
This is a pre-existing issue, but does this code create an unaligned memory
access?

In get_mc_temp(), the variable dword is initialized as:

    u32 *dword = (u32 *)hwmon->temp.value;

Since the value array is located at offset 10 in struct
xe_hwmon_thermal_info, this cast creates a misaligned 32-bit pointer.

When (dword + i) is passed to xe_pcode_read(), an unaligned 32-bit store
occurs. On strict-alignment architectures, this could cause an alignment
fault and kernel panic.

Because the temp1_input sysfs attribute is world-readable, could this allow
an unprivileged local user to trigger a denial of service?

>  		if (ret)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902175507.3910573-1-karthik.poosa@intel.com?part=3