[PATCH 1/7] drm/amdgpu/mmhub2.0: add bounds checking for cid

[PATCH 1/7] drm/amdgpu/mmhub2.0: add bounds checking for cid

[Alex Deucher]

The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
index a0cc8e218ca1e..534cb4c544dc4 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
@@ -154,14 +154,17 @@ mmhub_v2_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
 	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 	case IP_VERSION(2, 0, 0):
 	case IP_VERSION(2, 0, 2):
-		mmhub_cid = mmhub_client_ids_navi1x[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_navi1x) ?
+			mmhub_client_ids_navi1x[cid][rw] : NULL;
 		break;
 	case IP_VERSION(2, 1, 0):
 	case IP_VERSION(2, 1, 1):
-		mmhub_cid = mmhub_client_ids_sienna_cichlid[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_sienna_cichlid) ?
+			mmhub_client_ids_sienna_cichlid[cid][rw] : NULL;
 		break;
 	case IP_VERSION(2, 1, 2):
-		mmhub_cid = mmhub_client_ids_beige_goby[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_beige_goby) ?
+			mmhub_client_ids_beige_goby[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;
-- 
2.53.0

[PATCH 2/7] drm/amdgpu/mmhub2.3: add bounds checking for cid

[Alex Deucher]

The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c
index 5a071a788d933..3e0f147edbb9a 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_3.c
@@ -96,7 +96,8 @@ mmhub_v2_3_print_l2_protection_fault_status(struct amdgpu_device *adev,
 	case IP_VERSION(2, 3, 0):
 	case IP_VERSION(2, 4, 0):
 	case IP_VERSION(2, 4, 1):
-		mmhub_cid = mmhub_client_ids_vangogh[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_vangogh) ?
+			mmhub_client_ids_vangogh[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;
-- 
2.53.0

[PATCH 3/7] drm/amdgpu/mmhub3.0.1: add bounds checking for cid

[Alex Deucher]

The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
index 910337dc28d10..14a742d3a99d7 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_1.c
@@ -117,7 +117,8 @@ mmhub_v3_0_1_print_l2_protection_fault_status(struct amdgpu_device *adev,
 
 	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 	case IP_VERSION(3, 0, 1):
-		mmhub_cid = mmhub_client_ids_v3_0_1[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_1) ?
+			mmhub_client_ids_v3_0_1[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;
-- 
2.53.0

[PATCH 4/7] drm/amdgpu/mmhub3.0.2: add bounds checking for cid

[Alex Deucher]

The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c
index f0f182f033b98..e1f07f2a18527 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0_2.c
@@ -108,7 +108,8 @@ mmhub_v3_0_2_print_l2_protection_fault_status(struct amdgpu_device *adev,
 		"MMVM_L2_PROTECTION_FAULT_STATUS:0x%08X\n",
 		status);
 
-	mmhub_cid = mmhub_client_ids_v3_0_2[cid][rw];
+	mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_2) ?
+		mmhub_client_ids_v3_0_2[cid][rw] : NULL;
 	dev_err(adev->dev, "\t Faulty UTCL2 client ID: %s (0x%x)\n",
 		mmhub_cid ? mmhub_cid : "unknown", cid);
 	dev_err(adev->dev, "\t MORE_FAULTS: 0x%lx\n",
-- 
2.53.0

[PATCH 5/7] drm/amdgpu/mmhub3.0: add bounds checking for cid

[Alex Deucher]

The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c
index 7d5242df58a51..ab966e69a342a 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v3_0.c
@@ -110,7 +110,8 @@ mmhub_v3_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
 	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 	case IP_VERSION(3, 0, 0):
 	case IP_VERSION(3, 0, 1):
-		mmhub_cid = mmhub_client_ids_v3_0_0[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v3_0_0) ?
+			mmhub_client_ids_v3_0_0[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;
-- 
2.53.0

[PATCH 6/7] drm/amdgpu/mmhub4.1.0: add bounds checking for cid

[Alex Deucher]

The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c
index 951998454b257..88bfe321f83aa 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v4_1_0.c
@@ -102,7 +102,8 @@ mmhub_v4_1_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
 		status);
 	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 	case IP_VERSION(4, 1, 0):
-		mmhub_cid = mmhub_client_ids_v4_1_0[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v4_1_0) ?
+			mmhub_client_ids_v4_1_0[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;
-- 
2.53.0

[PATCH 7/7] drm/amdgpu/mmhub4.2.0: add bounds checking for cid

[Alex Deucher]

The value should never exceed the array size as those
are the only values the hardware is expected to return,
but add checks anyway.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/mmhub_v4_2_0.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v4_2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v4_2_0.c
index a72770e3d0e99..2532ca80f7356 100644
--- a/drivers/gpu/drm/amd/amdgpu/mmhub_v4_2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v4_2_0.c
@@ -688,7 +688,8 @@ mmhub_v4_2_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
 		status);
 	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
 	case IP_VERSION(4, 2, 0):
-		mmhub_cid = mmhub_client_ids_v4_2_0[cid][rw];
+		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_v4_2_0) ?
+			mmhub_client_ids_v4_2_0[cid][rw] : NULL;
 		break;
 	default:
 		mmhub_cid = NULL;
-- 
2.53.0

Re: [PATCH 1/7] drm/amdgpu/mmhub2.0: add bounds checking for cid

[Lazar, Lijo]

On 05-Mar-26 3:57 AM, Alex Deucher wrote:
> The value should never exceed the array size as those
> are the only values the hardware is expected to return,
> but add checks anyway.
> 
> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> ---
>   drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 9 ++++++---
>   1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
> index a0cc8e218ca1e..534cb4c544dc4 100644
> --- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
> +++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
> @@ -154,14 +154,17 @@ mmhub_v2_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
>   	switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
>   	case IP_VERSION(2, 0, 0):
>   	case IP_VERSION(2, 0, 2):
> -		mmhub_cid = mmhub_client_ids_navi1x[cid][rw];
> +		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_navi1x) ?

Does this introduce speculation and requirement to use array_index_nospec?

Thanks,
Lijo

> +			mmhub_client_ids_navi1x[cid][rw] : NULL;
>   		break;
>   	case IP_VERSION(2, 1, 0):
>   	case IP_VERSION(2, 1, 1):
> -		mmhub_cid = mmhub_client_ids_sienna_cichlid[cid][rw];
> +		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_sienna_cichlid) ?
> +			mmhub_client_ids_sienna_cichlid[cid][rw] : NULL;
>   		break;
>   	case IP_VERSION(2, 1, 2):
> -		mmhub_cid = mmhub_client_ids_beige_goby[cid][rw];
> +		mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_beige_goby) ?
> +			mmhub_client_ids_beige_goby[cid][rw] : NULL;
>   		break;
>   	default:
>   		mmhub_cid = NULL;

Re: [PATCH 1/7] drm/amdgpu/mmhub2.0: add bounds checking for cid

[Alex Deucher]

On Thu, Mar 5, 2026 at 10:24 AM Lazar, Lijo <lijo.lazar@amd.com> wrote:
>
>
>
> On 05-Mar-26 3:57 AM, Alex Deucher wrote:
> > The value should never exceed the array size as those
> > are the only values the hardware is expected to return,
> > but add checks anyway.
> >
> > Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> > ---
> >   drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 9 ++++++---
> >   1 file changed, 6 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
> > index a0cc8e218ca1e..534cb4c544dc4 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
> > @@ -154,14 +154,17 @@ mmhub_v2_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
> >       switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
> >       case IP_VERSION(2, 0, 0):
> >       case IP_VERSION(2, 0, 2):
> > -             mmhub_cid = mmhub_client_ids_navi1x[cid][rw];
> > +             mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_navi1x) ?
>
> Does this introduce speculation and requirement to use array_index_nospec?

I don't think so, but I'm not really an expert on side channel attacks.

Alex

>
> Thanks,
> Lijo
>
> > +                     mmhub_client_ids_navi1x[cid][rw] : NULL;
> >               break;
> >       case IP_VERSION(2, 1, 0):
> >       case IP_VERSION(2, 1, 1):
> > -             mmhub_cid = mmhub_client_ids_sienna_cichlid[cid][rw];
> > +             mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_sienna_cichlid) ?
> > +                     mmhub_client_ids_sienna_cichlid[cid][rw] : NULL;
> >               break;
> >       case IP_VERSION(2, 1, 2):
> > -             mmhub_cid = mmhub_client_ids_beige_goby[cid][rw];
> > +             mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_beige_goby) ?
> > +                     mmhub_client_ids_beige_goby[cid][rw] : NULL;
> >               break;
> >       default:
> >               mmhub_cid = NULL;
>

Re: [PATCH 1/7] drm/amdgpu/mmhub2.0: add bounds checking for cid

[Alex Deucher]

Ping on this series.

Alex

On Thu, Mar 5, 2026 at 11:16 AM Alex Deucher <alexdeucher@gmail.com> wrote:
>
> On Thu, Mar 5, 2026 at 10:24 AM Lazar, Lijo <lijo.lazar@amd.com> wrote:
> >
> >
> >
> > On 05-Mar-26 3:57 AM, Alex Deucher wrote:
> > > The value should never exceed the array size as those
> > > are the only values the hardware is expected to return,
> > > but add checks anyway.
> > >
> > > Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
> > > ---
> > >   drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 9 ++++++---
> > >   1 file changed, 6 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
> > > index a0cc8e218ca1e..534cb4c544dc4 100644
> > > --- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
> > > +++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
> > > @@ -154,14 +154,17 @@ mmhub_v2_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
> > >       switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
> > >       case IP_VERSION(2, 0, 0):
> > >       case IP_VERSION(2, 0, 2):
> > > -             mmhub_cid = mmhub_client_ids_navi1x[cid][rw];
> > > +             mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_navi1x) ?
> >
> > Does this introduce speculation and requirement to use array_index_nospec?
>
> I don't think so, but I'm not really an expert on side channel attacks.
>
> Alex
>
> >
> > Thanks,
> > Lijo
> >
> > > +                     mmhub_client_ids_navi1x[cid][rw] : NULL;
> > >               break;
> > >       case IP_VERSION(2, 1, 0):
> > >       case IP_VERSION(2, 1, 1):
> > > -             mmhub_cid = mmhub_client_ids_sienna_cichlid[cid][rw];
> > > +             mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_sienna_cichlid) ?
> > > +                     mmhub_client_ids_sienna_cichlid[cid][rw] : NULL;
> > >               break;
> > >       case IP_VERSION(2, 1, 2):
> > > -             mmhub_cid = mmhub_client_ids_beige_goby[cid][rw];
> > > +             mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_beige_goby) ?
> > > +                     mmhub_client_ids_beige_goby[cid][rw] : NULL;
> > >               break;
> > >       default:
> > >               mmhub_cid = NULL;
> >

Re: [PATCH 1/7] drm/amdgpu/mmhub2.0: add bounds checking for cid

[Benjamin Cheng]

On 2026-03-05 11:16, Alex Deucher wrote:
> On Thu, Mar 5, 2026 at 10:24 AM Lazar, Lijo <lijo.lazar@amd.com> wrote:
>>
>>
>> On 05-Mar-26 3:57 AM, Alex Deucher wrote:
>>> The value should never exceed the array size as those
>>> are the only values the hardware is expected to return,
>>> but add checks anyway.
>>>
>>> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
>>> ---
>>>   drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c | 9 ++++++---
>>>   1 file changed, 6 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
>>> index a0cc8e218ca1e..534cb4c544dc4 100644
>>> --- a/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
>>> +++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v2_0.c
>>> @@ -154,14 +154,17 @@ mmhub_v2_0_print_l2_protection_fault_status(struct amdgpu_device *adev,
>>>       switch (amdgpu_ip_version(adev, MMHUB_HWIP, 0)) {
>>>       case IP_VERSION(2, 0, 0):
>>>       case IP_VERSION(2, 0, 2):
>>> -             mmhub_cid = mmhub_client_ids_navi1x[cid][rw];
>>> +             mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_navi1x) ?
>> Does this introduce speculation and requirement to use array_index_nospec?
> I don't think so, but I'm not really an expert on side channel attacks.
>
> Alex

Also not an expert here but I don't think this can be used as an exploit. The cid is read from HW and is not controllable by users.

This series is:

Reviewed-by: Benjamin Cheng <benjamin.cheng@amd.com>

>
>> Thanks,
>> Lijo
>>
>>> +                     mmhub_client_ids_navi1x[cid][rw] : NULL;
>>>               break;
>>>       case IP_VERSION(2, 1, 0):
>>>       case IP_VERSION(2, 1, 1):
>>> -             mmhub_cid = mmhub_client_ids_sienna_cichlid[cid][rw];
>>> +             mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_sienna_cichlid) ?
>>> +                     mmhub_client_ids_sienna_cichlid[cid][rw] : NULL;
>>>               break;
>>>       case IP_VERSION(2, 1, 2):
>>> -             mmhub_cid = mmhub_client_ids_beige_goby[cid][rw];
>>> +             mmhub_cid = cid < ARRAY_SIZE(mmhub_client_ids_beige_goby) ?
>>> +                     mmhub_client_ids_beige_goby[cid][rw] : NULL;
>>>               break;
>>>       default:
>>>               mmhub_cid = NULL;