Re: [PATCH 1/5] drm/xe/xe_drm_ras: Rename ras to drm_ras in xe_device

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing bounds check on severity and component indices in xe_drm_ras_event()
--

--- Patch [1]: [PATCH 1/5] drm/xe/xe_drm_ras: Rename ras to drm_ras in xe_device ---
commit 32a6f8d58b55e63675c6423a6648130b2ff82f4c
Author: Riana Tauro <riana.tauro@intel.com>

drm/xe/xe_drm_ras: Rename ras to drm_ras in xe_device

Rename ras to drm_ras in xe_device to distinguish drm-ras functionality
from device related RAS functionality. No functional changes.

> diff --git a/drivers/gpu/drm/xe/xe_drm_ras.c b/drivers/gpu/drm/xe/xe_drm_ras.c
> index 78184b6ea7d48..9f37ae732770a 100644
> --- a/drivers/gpu/drm/xe/xe_drm_ras.c
> +++ b/drivers/gpu/drm/xe/xe_drm_ras.c

[ ... ]

> @@ -196,7 +196,7 @@ static int register_nodes(struct xe_device *xe)
>   */
>  void xe_drm_ras_event(struct xe_device *xe, u32 component, u32 severity, u32 value)
>  {
> -	struct xe_drm_ras *ras = &xe->ras;
> +	struct xe_drm_ras *ras = &xe->drm_ras;
>  	struct xe_drm_ras_counter *info = ras->info[severity];

[Severity: High]
This is a pre-existing issue, but is it possible for severity or component
to be out of bounds here?

If firmware or hardware sends a telemetry event with an unrecognized
severity or component, fallback paths might return DRM_XE_RAS_ERR_SEV_MAX
or DRM_XE_RAS_ERR_COMP_MAX.

Since ras->info is sized up to DRM_XE_RAS_ERR_SEV_MAX, using it as an index
reads past the end of the array. Because info is the final member of
struct xe_drm_ras inside struct xe_device, ras->info[DRM_XE_RAS_ERR_SEV_MAX]
could fetch the adjacent xe->i2c pointer. 

The code would then treat this as an array of struct xe_drm_ras_counter, 
which could lead to an invalid pointer dereference when evaluating 
info[component].name later in the function.

Should there be bounds checks for severity and component before indexing
the arrays in xe_drm_ras_event()?

>  	struct drm_ras_node *node;
>  	int ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825063615.3697317-7-riana.tauro@intel.com?part=1