Re: [PATCH v4 2/3] drm/xe/ggtt: Initialize GGTT pools by SR-IOV mode

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Integer overflow in GGTT bounds check enables out-of-bounds memory access.
--

commit f9f8d4706aa1161e82f40e54588776b342483570
Author: Piotr Piórkowski <piotr.piorkowski@intel.com>
drm/xe/ggtt: Initialize GGTT pools by SR-IOV mode

This commit separates GGTT range discovery from pool setup and initializes
the usable and shareable pools based on the SR-IOV mode.

> diff --git a/drivers/gpu/drm/xe/xe_ggtt.c b/drivers/gpu/drm/xe/xe_ggtt.c
> index fa77abbb3cd5a..7d22b0cbcaec6 100644
> --- a/drivers/gpu/drm/xe/xe_ggtt.c
> +++ b/drivers/gpu/drm/xe/xe_ggtt.c
[ ... ]
> +static int ggtt_get_range_from_guc(struct xe_ggtt *ggtt, u64 *start, u64 *size)
> +{
> +	struct xe_device *xe = tile_to_xe(ggtt->tile);
> +	u64 wopcm = xe_wopcm_size(xe);
> +
> +	*start = xe_tile_sriov_vf_ggtt_base(ggtt->tile);
> +	*size = xe_tile_sriov_vf_ggtt(ggtt->tile);
> +
> +	if (*start < wopcm || *start + *size > GUC_GGTT_TOP) {

[Severity: High]
This isn't a bug introduced by this patch, but is there a risk of an integer
overflow occurring in this bounds check?

If a compromised PF or malicious GuC firmware provides extremely large values
for the start and size parameters via GUC_KLV_VF_CFG_GGTT_START_KEY, could
*start + *size wrap around to a small value? If this happens, the sum might
evaluate to less than GUC_GGTT_TOP, which would successfully bypass this
boundary check despite being invalid.

If bypassed, the overflowed start address would later be applied as an
offset during operations like xe_ggtt_insert_node(). This could result in
indexing out-of-bounds into the ggtt->gsm array, leading to kernel memory
corruption or a kernel panic. In Confidential Compute environments, this
might provide a host-to-guest escalation vector.

> +		xe_tile_err(ggtt->tile, "Invalid GGTT configuration: %#llx-%#llx\n",
> +			    *start, *start + *size - 1);
> +		return -ERANGE;
> +	}
> +
> +	return 0;
> +}
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260901164435.1395260-1-piotr.piorkowski@intel.com?part=2