Re: [PATCH 3/3] drm/xe/hwmon: Correct group selection for memory controller temperature

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Buffer overflow in memory controller temperature read loop due to unsafe loop upper bound.
--

--- Patch [3]: [PATCH 3/3] drm/xe/hwmon: Correct group selection for memory controller temperature ---
commit 06143d547f9d92b56105a4e1bd787aaee0504176
Author: Karthik Poosa <karthik.poosa@intel.com>

drm/xe/hwmon: Correct group selection for memory controller temperature

This commit updates get_mc_temp() to read all necessary groups based on
hwmon->temp.count instead of the TEMP_LIMIT_MAX macro.

> diff --git a/drivers/gpu/drm/xe/xe_hwmon.c b/drivers/gpu/drm/xe/xe_hwmon.c
> --- a/drivers/gpu/drm/xe/xe_hwmon.c
> +++ b/drivers/gpu/drm/xe/xe_hwmon.c
> @@ -820,7 +820,7 @@ static int get_mc_temp(struct xe_hwmon *hwmon, long *val)
>  	int ret, i, count = 0;
>  	s32 average = 0;
>  
> -	for (i = 0; i < DIV_ROUND_UP(TEMP_LIMIT_MAX, sizeof(u32)); i++) {
> +	for (i = 0; i < DIV_ROUND_UP(hwmon->temp.count, sizeof(u32)); i++) {
>  		ret = xe_pcode_read(root_tile, PCODE_MBOX(PCODE_THERMAL_INFO, READ_THERMAL_DATA, i),
>  				    (dword + i), NULL);

[Severity: High]
If hwmon->temp.count is populated directly from a hardware register field
without validation, could it take values up to 255?

If hwmon->temp.count is between 253 and 255, DIV_ROUND_UP will evaluate to 64.
The loop would execute 64 times, reading 4 bytes per iteration and writing a
total of 256 bytes into the dword array, which aliases hwmon->temp.value.

Since hwmon->temp.value is defined as s8 value[U8_MAX] (exactly 255 bytes),
does this cause a 1-byte out-of-bounds write past the end of the array?

While this overflow might currently land in struct padding due to alignment
requirements of subsequent fields, could it corrupt adjacent data if the
struct layout changes in the future?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824184137.2164727-1-karthik.poosa@intel.com?part=3