Re: [PATCH v11 15/16] drm/xe: Validate thermal sensor count before reads

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/xe/hwmon: memory controller temperature incorrectly averages PCIe sensor
--

commit 560df9ca7dd177faf766f62db4da531e993c1514
Author: Karthik Poosa <karthik.poosa@intel.com>

drm/xe: Validate thermal sensor count before reads

This commit adds boundary checks to verify that READ_THERMAL_CONFIG reports
enough entries for the platform-specific memory controller and PCIe sensor
indices before attempting to read thermal data.

> diff --git a/drivers/gpu/drm/xe/xe_hwmon.c b/drivers/gpu/drm/xe/xe_hwmon.c
> index 7311f969f574f..702c739c9bf0a 100644
> --- a/drivers/gpu/drm/xe/xe_hwmon.c
> +++ b/drivers/gpu/drm/xe/xe_hwmon.c
> @@ -920,6 +920,13 @@ static int get_mc_temp(struct xe_hwmon *hwmon, long *val)
>  		end = hwmon->temp.count - 1;
>  	}
>  
> +	if (end <= start || end > hwmon->temp.count) {
> +		drm_warn(&hwmon->xe->drm,
> +			 "memory controller range [%d, %d) is invalid for temperature count %d\n",
> +			 start, end, hwmon->temp.count);
> +		return -ENODATA;
> +	}
> +

[Severity: Medium]
If the firmware reports a thermal config count such that hwmon->temp.count - 1
exceeds the hardcoded PCIe sensor index, will get_mc_temp() mistakenly average
the PCIe sensor into the memory controller temperature?

While the validation added here allows hwmon->temp.count - 1 to be larger than
the PCIe sensor index, get_mc_temp() statically bounds its loop using
end = hwmon->temp.count - 1. This could force the memory controller loop to
iterate past the intended MCTRL range and consume the PCIe sensor located at
that index:

    for (i = start; i < end; i++) {
        if (!mbx_temp_valid(hwmon, hwmon->temp.value[i]))
            continue;
        average += mbx_temp_decode(hwmon->temp.value[i]);
        count++;
    }

Should end be explicitly capped at xe_hwmon_pcie_temp_index(hwmon) when
calculating the memory controller average to prevent polluting the statistics
with out-of-range sensors?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013020636.447620-1-karthik.poosa@intel.com?part=15