Re: [PATCH 3/3] drm/xe/hwmon: Correct group selection for memory controller temperature

["Poosa, Karthik" <karthik.poosa@intel.com>]

On 25-08-2026 00:24, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Out-of-bounds write of 1 byte into `hwmon->temp.value` when reading thermal data from pcode if the sensor count exceeds 252.
> --
>
> --- Patch [3]: [PATCH 3/3] drm/xe/hwmon: Correct group selection for memory controller temperature ---
> commit d6bd40537c53d76ef6df15e33458ad0d982f56b1
> Author: Karthik Poosa <karthik.poosa@intel.com>
>
> drm/xe/hwmon: Correct group selection for memory controller temperature
>      
> This patch corrects the memory controller temperature group selection by
> updating get_mc_temp() to read all necessary groups based on the actual
> sensor count rather than a hardcoded maximum.
>
>> diff --git a/drivers/gpu/drm/xe/xe_hwmon.c b/drivers/gpu/drm/xe/xe_hwmon.c
>> --- a/drivers/gpu/drm/xe/xe_hwmon.c
>> +++ b/drivers/gpu/drm/xe/xe_hwmon.c
> [ ... ]
>
>> @@ -820,7 +820,7 @@ static int get_mc_temp(struct xe_hwmon *hwmon, long *val)
>>   	int ret, i, count = 0;
>>   	s32 average = 0;
>>   
>> -	for (i = 0; i < DIV_ROUND_UP(TEMP_LIMIT_MAX, sizeof(u32)); i++) {
>> +	for (i = 0; i < DIV_ROUND_UP(hwmon->temp.count, sizeof(u32)); i++) {
> [Severity: Medium]
> Could this lead to an out-of-bounds write into hwmon->temp.value if the
> hardware returns a sensor count greater than 252?
>
> If hwmon->temp.count is between 253 and 255, the DIV_ROUND_UP calculation
> evaluates to 64. The loop will execute 64 times, reading 4 bytes per
> iteration, resulting in 256 bytes being written to the dword pointer.
>
> Since dword points to hwmon->temp.value, which is sized at 255 bytes, this
> will write past the end of the array by 1 byte.
>
>>   		ret = xe_pcode_read(root_tile, PCODE_MBOX(PCODE_THERMAL_INFO, READ_THERMAL_DATA, i),
>>   				    (dword + i), NULL);
>>   		if (ret)
> Yes, I shall change the hwmon->temp.value size from U8_MAX to U8_MAX+1 
> @@ -149,7 +149,7 @@ struct xe_hwmon_thermal_info { /** @value: signed 
> value from each sensor */ - s8 value[U8_MAX]; + s8 value[U8_MAX + 1]; };