Re: [PATCH] accel/rocket: Report per-core engine usage through fdinfo

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] accel/rocket: out-of-bounds access on elapsed_ns[] when num_cores changes
--

commit 2905630551e831e7463221f4054336a62cdc4cc3
Author: Sidong Yang <sidong.yang@furiosa.ai>

accel/rocket: Report per-core engine usage through fdinfo

This commit adds per-core engine usage accounting for client jobs on the
Rocket NPU and exposes the per-core elapsed nanoseconds and BO memory stats
through fdinfo.

> diff --git a/drivers/accel/rocket/rocket_drv.c b/drivers/accel/rocket/rocket_drv.c
> index 8bbbce594883e..5b81d1ecc0e49 100644
> --- a/drivers/accel/rocket/rocket_drv.c
> +++ b/drivers/accel/rocket/rocket_drv.c

[ ... ]

> @@ -86,10 +107,19 @@ rocket_open(struct drm_device *dev, struct drm_file *file)
>  	}
>  
>  	rocket_priv->rdev = rdev;
> +
> +	rocket_priv->engine_usage = kzalloc_flex(*rocket_priv->engine_usage,
> +						 elapsed_ns, rdev->num_cores);
> +	if (!rocket_priv->engine_usage) {
> +		ret = -ENOMEM;
> +		goto err_free;
> +	}
> +	kref_init(&rocket_priv->engine_usage->kref);
> +
>  	rocket_priv->domain = rocket_iommu_domain_create(rdev->cores[0].dev);
>  	if (IS_ERR(rocket_priv->domain)) {
>  		ret = PTR_ERR(rocket_priv->domain);
> -		goto err_free;
> +		goto err_put_engine_usage;
>  	}

[ ... ]

> @@ -139,7 +172,29 @@ static const struct drm_ioctl_desc rocket_drm_driver_ioctls[] = {
>  	ROCKET_IOCTL(FINI_BO, fini_bo),
>  };
>  
> -DEFINE_DRM_ACCEL_FOPS(rocket_accel_driver_fops);
> +static void rocket_show_fdinfo(struct drm_printer *p, struct drm_file *file)
> +{
> +	struct rocket_device *rdev = to_rocket_device(file->minor->dev);
> +	struct rocket_file_priv *rocket_priv = file->driver_priv;
> +	unsigned int core;
> +
> +	/*
> +	 * These are estimates: the time is taken around the whole period a job
> +	 * occupies a core, so it also covers handling the completion interrupt
> +	 * and, for a job made of several tasks, the gaps between them.
> +	 */
> +	for (core = 0; core < rdev->num_cores; core++)
> +		drm_printf(p, "drm-engine-npu%u:\t%llu ns\n", core,
> +			   rocket_priv->engine_usage->elapsed_ns[core]);

[Severity: High]
Can this read or write past the end of rocket_priv->engine_usage->elapsed_ns[]
if rdev->num_cores changes after rocket_open()?

In rocket_probe(), the DRM device is registered via rocket_device_init() ->
drm_dev_register() when the first core probes, and rdev->num_cores is then
incremented one by one as each subsequent core probes:

drivers/accel/rocket/rocket_drv.c:rocket_probe() {
	if (rdev == NULL) {
		/* First core probing, initialize DRM device. */
		rdev = rocket_device_init(drm_dev, &rocket_drm_driver);
		...
	}

	unsigned int core = rdev->num_cores;
	...
	rdev->cores[core].index = core;

	rdev->num_cores++;
}

If userspace (for example systemd-udevd reacting to the drm_dev_register()
uevent, or a client opening the device while remaining cores are still probing
or deferred) calls rocket_open() before all cores have finished probing,
rocket_priv->engine_usage is allocated with the smaller rdev->num_cores count
at that moment. Once the remaining cores finish probing and increment
rdev->num_cores, calling rocket_show_fdinfo() will iterate up to the new
rdev->num_cores and read past the end of elapsed_ns[].

Similarly, if a lower-indexed core is unbound via rocket_remove(),
rdev->num_cores is decremented while higher-indexed cores retain their
original core->index. If a file is opened afterwards, rocket_job_handle_irq()
indexing engine_usage->elapsed_ns[core->index] can also write out of bounds:

drivers/accel/rocket/rocket_job.c:rocket_job_handle_irq() {
	...
	core->in_flight_job->engine_usage->elapsed_ns[core->index] +=
		local_clock() - core->in_flight_job->start_ns;
	...
}

Would it make sense to record the total core count allocated for rdev->cores
in rocket_device_init() (or store the allocated array length in struct
rocket_engine_usage) so that the allocation size and bounds stay consistent?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261031083642.1076356-1-sidong.yang@furiosa.ai?part=1