[bug report] drm/amdkfd: add debug set and clear address watch points operation

[bug report] drm/amdkfd: add debug set and clear address watch points operation

[Dan Carpenter]

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Jonathan Kim,

Commit e0f85f4690d0 ("drm/amdkfd: add debug set and clear address
watch points operation") from May 6, 2022 (linux-next), leads to the
following Smatch static checker warning:

	drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c:448 kfd_dbg_trap_clear_dev_address_watch()
	error: buffer overflow 'pdd->watch_points' 4 <= u32max user_rl='0-3,2147483648-u32max' uncapped

drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_debug.c
    433 int kfd_dbg_trap_clear_dev_address_watch(struct kfd_process_device *pdd,
    434                                         uint32_t watch_id)
    435 {
    436         int r;
    437 
    438         if (!kfd_dbg_owns_dev_watch_id(pdd, watch_id))

kfd_dbg_owns_dev_watch_id() doesn't check for negative values so
if watch_id is larger than INT_MAX it leads to a buffer overflow.
(Negative shifts are undefined).

    439                 return -EINVAL;
    440 
    441         if (!pdd->dev->kfd->shared_resources.enable_mes) {
    442                 r = debug_lock_and_unmap(pdd->dev->dqm);
    443                 if (r)
    444                         return r;
    445         }
    446 
    447         amdgpu_gfx_off_ctrl(pdd->dev->adev, false);
--> 448         pdd->watch_points[watch_id] = pdd->dev->kfd2kgd->clear_address_watch(
    449                                                         pdd->dev->adev,
    450                                                         watch_id);
    451         amdgpu_gfx_off_ctrl(pdd->dev->adev, true);
    452 
    453         if (!pdd->dev->kfd->shared_resources.enable_mes)
    454                 r = debug_map_and_unlock(pdd->dev->dqm);
    455         else
    456                 r = kfd_dbg_set_mes_debug_mode(pdd, true);
    457 
    458         kfd_dbg_clear_dev_watch_id(pdd, watch_id);
    459 
    460         return r;
    461 }

regards,
dan carpenter

[bug report] drm/amd/display: add DC changes for DCN351

[Dan Carpenter]

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Hamza Mahfooz,

Commit 2728e9c7c842 ("drm/amd/display: add DC changes for DCN351")
from Feb 23, 2024 (linux-next), leads to the following Smatch static
checker warning:

drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c:1284 dcn35_stream_encoder_create() index hardmax out of bounds 'stream_enc_regs[eng_id]' size=5 max='5' rl='s32min-5'
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn36/dcn36_resource.c:1285 dcn35_stream_encoder_create() index hardmax out of bounds 'stream_enc_regs[eng_id]' size=5 max='5' rl='s32min-5'
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn321/dcn321_resource.c:1222 dcn321_stream_encoder_create() index hardmax out of bounds 'stream_enc_regs[eng_id]' size=5 max='5' rl='s32min-5'
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn315/dcn315_resource.c:1252 dcn315_stream_encoder_create() index hardmax out of bounds 'stream_enc_regs[eng_id]' size=5 max='5' rl='s32min-5'
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn35/dcn35_resource.c:1304 dcn35_stream_encoder_create() index hardmax out of bounds 'stream_enc_regs[eng_id]' size=5 max='5' rl='s32min-5'
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn32/dcn32_resource.c:1241 dcn32_stream_encoder_create() index hardmax out of bounds 'stream_enc_regs[eng_id]' size=5 max='5' rl='s32min-5'
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn316/dcn316_resource.c:1245 dcn316_stream_encoder_create() index hardmax out of bounds 'stream_enc_regs[eng_id]' size=5 max='5' rl='s32min-5'

drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c
    1246 static struct stream_encoder *dcn35_stream_encoder_create(
    1247         enum engine_id eng_id,
    1248         struct dc_context *ctx)
    1249 {
    1250         struct dcn10_stream_encoder *enc1;
    1251         struct vpg *vpg;
    1252         struct afmt *afmt;
    1253         int vpg_inst;
    1254         int afmt_inst;
    1255 
    1256         /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */
    1257         if (eng_id <= ENGINE_ID_DIGF) {

ENGINE_ID_DIGF is 5.  should <= be <?

Unrelated but, ugh, why is Smatch saying that "eng_id" can be negative?
end_id is type signed long, but there are checks in the caller which
prevent it from being negative.

    1258                 vpg_inst = eng_id;
    1259                 afmt_inst = eng_id;
    1260         } else
    1261                 return NULL;
    1262 
    1263         enc1 = kzalloc(sizeof(struct dcn10_stream_encoder), GFP_KERNEL);
    1264         vpg = dcn31_vpg_create(ctx, vpg_inst);
    1265         afmt = dcn31_afmt_create(ctx, afmt_inst);
    1266 
    1267         if (!enc1 || !vpg || !afmt) {
    1268                 kfree(enc1);
    1269                 kfree(vpg);
    1270                 kfree(afmt);
    1271                 return NULL;
    1272         }
    1273 
    1274 #undef REG_STRUCT
    1275 #define REG_STRUCT stream_enc_regs
    1276         stream_enc_regs_init(0),
    1277         stream_enc_regs_init(1),
    1278         stream_enc_regs_init(2),
    1279         stream_enc_regs_init(3),
    1280         stream_enc_regs_init(4);
    1281 
    1282         dcn35_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
    1283                                         eng_id, vpg, afmt,
--> 1284                                         &stream_enc_regs[eng_id],
                                                  ^^^^^^^^^^^^^^^^^^^^^^^
This stream_enc_regs[] array has 5 elements so we are one element
beyond the end of the array.

    1285                                         &se_shift, &se_mask);
    1286 
    1287         return &enc1->base;
    1288 }

regards,
dan carpenter

[bug report] drm/amd/display: Only poll analog connectors

[Dan Carpenter]

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Timur Kristóf,

Commit f6cc7f1c11a7 ("drm/amd/display: Only poll analog connectors")
from Jan 18, 2026 (linux-next), leads to the following Smatch static
checker warning:

	drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()
	error: we previously assumed 'dc_link' could be null (see line 931)

drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c
    923                 /*
    924                  * Analog connectors may be hot-plugged unlike other connector
    925                  * types that don't support HPD. Only poll analog connectors.
    926                  */
    927                 use_polling |=
    928                         amdgpu_dm_connector->dc_link &&
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
The patch adds this NULL check but hopefully it can be removed

    929                         dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);
    930 
    931                 dc_link = amdgpu_dm_connector->dc_link;

dc_link assigned here.

    932 
    933                 /*
    934                  * Get a base driver irq reference for hpd ints for the lifetime
    935                  * of dm. Note that only hpd interrupt types are registered with
    936                  * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on
    937                  * hpd_rx isn't available. DM currently controls hpd_rx
    938                  * explicitly with dc_interrupt_set()
    939                  */
--> 940                 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {
                            ^^^^^^^^^^^^^^^^^^^^^^^
If it's NULL then we are trouble because we dereference it here.

    941                         irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;
    942                         /*
    943                          * TODO: There's a mismatch between mode_info.num_hpd
    944                          * and what bios reports as the # of connectors with hpd

regards,
dan carpenter

[bug report] drm/amdgpu: fix possible fence leaks from job structure

[Dan Carpenter]

[ Smatch checking is paused while we raise funding.  #SadFace
  https://lore.kernel.org/all/aTaiGSbWZ9DJaGo7@stanley.mountain/ -dan ]

Hello Alex Deucher,

Commit f903b85ed0f1 ("drm/amdgpu: fix possible fence leaks from job
structure") from Oct 22, 2025 (linux-next), leads to the following
Smatch static checker warning:

	drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c:232 amdgpu_ib_schedule()
	warn: missing unwind goto?

drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
    124 int amdgpu_ib_schedule(struct amdgpu_ring *ring, unsigned int num_ibs,
    125                        struct amdgpu_ib *ibs, struct amdgpu_job *job,
    126                        struct dma_fence **f)
    127 {
    128         struct amdgpu_device *adev = ring->adev;
    129         struct amdgpu_ib *ib = &ibs[0];
    130         struct dma_fence *tmp = NULL;
    131         struct amdgpu_fence *af;
    132         bool need_ctx_switch;
    133         struct amdgpu_vm *vm;
    134         uint64_t fence_ctx;
    135         uint32_t status = 0, alloc_size;
    136         unsigned int fence_flags = 0;
    137         bool secure, init_shadow;
    138         u64 shadow_va, csa_va, gds_va;
    139         int vmid = AMDGPU_JOB_GET_VMID(job);
    140         bool need_pipe_sync = false;
    141         unsigned int cond_exec;
    142         unsigned int i;
    143         int r = 0;
    144 
    145         if (num_ibs == 0)
    146                 return -EINVAL;
    147 
    148         /* ring tests don't use a job */
    149         if (job) {
    150                 vm = job->vm;
    151                 fence_ctx = job->base.s_fence ?
    152                         job->base.s_fence->finished.context : 0;
    153                 shadow_va = job->shadow_va;
    154                 csa_va = job->csa_va;
    155                 gds_va = job->gds_va;
    156                 init_shadow = job->init_shadow;
    157                 af = job->hw_fence;
    158                 /* Save the context of the job for reset handling.
    159                  * The driver needs this so it can skip the ring
    160                  * contents for guilty contexts.
    161                  */
    162                 af->context = fence_ctx;
    163                 /* the vm fence is also part of the job's context */
    164                 job->hw_vm_fence->context = fence_ctx;
    165         } else {
    166                 vm = NULL;
    167                 fence_ctx = 0;
    168                 shadow_va = 0;
    169                 csa_va = 0;
    170                 gds_va = 0;
    171                 init_shadow = false;
    172                 af = kzalloc(sizeof(*af), GFP_ATOMIC);
    173                 if (!af)
    174                         return -ENOMEM;
    175         }
    176 
    177         if (!ring->sched.ready) {
    178                 dev_err(adev->dev, "couldn't schedule ib on ring <%s>\n", ring->name);
    179                 r = -EINVAL;
    180                 goto free_fence;
    181         }
    182 
    183         if (vm && !job->vmid) {
    184                 dev_err(adev->dev, "VM IB without ID\n");
    185                 r = -EINVAL;
    186                 goto free_fence;
    187         }
    188 
    189         if ((ib->flags & AMDGPU_IB_FLAGS_SECURE) &&
    190             (!ring->funcs->secure_submission_supported)) {
    191                 dev_err(adev->dev, "secure submissions not supported on ring <%s>\n", ring->name);
    192                 r = -EINVAL;
    193                 goto free_fence;
    194         }
    195 
    196         alloc_size = ring->funcs->emit_frame_size + num_ibs *
    197                 ring->funcs->emit_ib_size;
    198 
    199         r = amdgpu_ring_alloc(ring, alloc_size);
    200         if (r) {
    201                 dev_err(adev->dev, "scheduling IB failed (%d).\n", r);
    202                 goto free_fence;
    203         }
    204 
    205         need_ctx_switch = ring->current_ctx != fence_ctx;
    206         if (ring->funcs->emit_pipeline_sync && job &&
    207             ((tmp = amdgpu_sync_get_fence(&job->explicit_sync)) ||
    208              need_ctx_switch || amdgpu_vm_need_pipeline_sync(ring, job))) {
    209 
    210                 need_pipe_sync = true;
    211 
    212                 if (tmp)
    213                         trace_amdgpu_ib_pipe_sync(job, tmp);
    214 
    215                 dma_fence_put(tmp);
    216         }
    217 
    218         if ((ib->flags & AMDGPU_IB_FLAG_EMIT_MEM_SYNC) && ring->funcs->emit_mem_sync)
    219                 ring->funcs->emit_mem_sync(ring);
    220 
    221         if (ring->funcs->emit_wave_limit &&
    222             ring->hw_prio == AMDGPU_GFX_PIPE_PRIO_HIGH)
    223                 ring->funcs->emit_wave_limit(ring, true);
    224 
    225         if (ring->funcs->insert_start)
    226                 ring->funcs->insert_start(ring);
    227 
    228         if (job) {
    229                 r = amdgpu_vm_flush(ring, job, need_pipe_sync);
    230                 if (r) {
    231                         amdgpu_ring_undo(ring);
--> 232                         return r;

The patch changed the other error paths to goto free_fence but this
one was accidentally skipped.

    233                 }
    234         }
    235 
    236         amdgpu_ring_ib_begin(ring);
    237 
    238         if (ring->funcs->emit_gfx_shadow && adev->gfx.cp_gfx_shadow)
    239                 amdgpu_ring_emit_gfx_shadow(ring, shadow_va, csa_va, gds_va,
    240                                             init_shadow, vmid);
    241 
    242         if (ring->funcs->init_cond_exec)
    243                 cond_exec = amdgpu_ring_init_cond_exec(ring,
    244                                                        ring->cond_exe_gpu_addr);
    245 
    246         amdgpu_device_flush_hdp(adev, ring);
    247 
    248         if (need_ctx_switch)
    249                 status |= AMDGPU_HAVE_CTX_SWITCH;
    250 
    251         if (job && ring->funcs->emit_cntxcntl) {
    252                 status |= job->preamble_status;
    253                 status |= job->preemption_status;
    254                 amdgpu_ring_emit_cntxcntl(ring, status);
    255         }
    256 
    257         /* Setup initial TMZiness and send it off.
    258          */
    259         secure = false;
    260         if (job && ring->funcs->emit_frame_cntl) {
    261                 secure = ib->flags & AMDGPU_IB_FLAGS_SECURE;
    262                 amdgpu_ring_emit_frame_cntl(ring, true, secure);
    263         }
    264 
    265         for (i = 0; i < num_ibs; ++i) {
    266                 ib = &ibs[i];
    267 
    268                 if (job && ring->funcs->emit_frame_cntl) {
    269                         if (secure != !!(ib->flags & AMDGPU_IB_FLAGS_SECURE)) {
    270                                 amdgpu_ring_emit_frame_cntl(ring, false, secure);
    271                                 secure = !secure;
    272                                 amdgpu_ring_emit_frame_cntl(ring, true, secure);
    273                         }
    274                 }
    275 
    276                 amdgpu_ring_emit_ib(ring, job, ib, status);
    277                 status &= ~AMDGPU_HAVE_CTX_SWITCH;
    278         }
    279 
    280         if (job && ring->funcs->emit_frame_cntl)
    281                 amdgpu_ring_emit_frame_cntl(ring, false, secure);
    282 
    283         amdgpu_device_invalidate_hdp(adev, ring);
    284 
    285         if (ib->flags & AMDGPU_IB_FLAG_TC_WB_NOT_INVALIDATE)
    286                 fence_flags |= AMDGPU_FENCE_FLAG_TC_WB_ONLY;
    287 
    288         /* wrap the last IB with fence */
    289         if (job && job->uf_addr) {
    290                 amdgpu_ring_emit_fence(ring, job->uf_addr, job->uf_sequence,
    291                                        fence_flags | AMDGPU_FENCE_FLAG_64BIT);
    292         }
    293 
    294         if (ring->funcs->emit_gfx_shadow && ring->funcs->init_cond_exec &&
    295             adev->gfx.cp_gfx_shadow) {
    296                 amdgpu_ring_emit_gfx_shadow(ring, 0, 0, 0, false, 0);
    297                 amdgpu_ring_init_cond_exec(ring, ring->cond_exe_gpu_addr);
    298         }
    299 
    300         r = amdgpu_fence_emit(ring, af, fence_flags);
    301         if (r) {
    302                 dev_err(adev->dev, "failed to emit fence (%d)\n", r);
    303                 if (job && job->vmid)
    304                         amdgpu_vmid_reset(adev, ring->vm_hub, job->vmid);
    305                 amdgpu_ring_undo(ring);
    306                 goto free_fence;
    307         }
    308         *f = &af->base;
    309         /* get a ref for the job */
    310         if (job)
    311                 dma_fence_get(*f);
    312 
    313         if (ring->funcs->insert_end)
    314                 ring->funcs->insert_end(ring);
    315 
    316         amdgpu_ring_patch_cond_exec(ring, cond_exec);
    317 
    318         ring->current_ctx = fence_ctx;
    319         if (job && ring->funcs->emit_switch_buffer)
    320                 amdgpu_ring_emit_switch_buffer(ring);
    321 
    322         if (ring->funcs->emit_wave_limit &&
    323             ring->hw_prio == AMDGPU_GFX_PIPE_PRIO_HIGH)
    324                 ring->funcs->emit_wave_limit(ring, false);
    325 
    326         /* Save the wptr associated with this fence.
    327          * This must be last for resets to work properly
    328          * as we need to save the wptr associated with this
    329          * fence so we know what rings contents to backup
    330          * after we reset the queue.
    331          */
    332         amdgpu_fence_save_wptr(af);
    333 
    334         amdgpu_ring_ib_end(ring);
    335         amdgpu_ring_commit(ring);
    336 
    337         return 0;
    338 
    339 free_fence:
    340         if (!job)
    341                 kfree(af);
    342         return r;
    343 }

regards,
dan carpenter