public inbox for intel-xe@lists.freedesktop.org
 help / color / mirror / Atom feed
* [PATCH] drm/xe: Fix overflow in guc_ct_snapshot_capture
@ 2026-03-04 11:25 Mika Kuoppala
  2026-03-04 16:39 ` Matthew Brost
                   ` (7 more replies)
  0 siblings, 8 replies; 12+ messages in thread
From: Mika Kuoppala @ 2026-03-04 11:25 UTC (permalink / raw)
  To: intel-xe
  Cc: Mika Kuoppala, Matthew Brost, Thomas Hellström, Rodrigo Vivi

snapshot->ctb is u32*, so pointer arithmetic on it scales
the byte offset from xe_bo_size() by 4, overshooting the
intended start of the g2h portion and writing past the
allocated buffer.

Fix this by using *u8 to get the arithmetic right and also
prevent future mishaps.

Fixes: af3de6cf06f9 ("drm/xe: Split H2G and G2H into separate buffer objects")
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: "Thomas Hellström" <thomas.hellstrom@linux.intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: intel-xe@lists.freedesktop.org
Signed-off-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
---
 drivers/gpu/drm/xe/xe_guc_ct_types.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_guc_ct_types.h b/drivers/gpu/drm/xe/xe_guc_ct_types.h
index 46ad1402347d..1b4b9b713d42 100644
--- a/drivers/gpu/drm/xe/xe_guc_ct_types.h
+++ b/drivers/gpu/drm/xe/xe_guc_ct_types.h
@@ -74,7 +74,7 @@ struct xe_guc_ct_snapshot {
 	/** @ctb_size: size of the snapshot of the CTB */
 	size_t ctb_size;
 	/** @ctb: snapshot of the entire CTB */
-	u32 *ctb;
+	u8 *ctb;
 };
 
 /**
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2026-03-06 16:04 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-04 11:25 [PATCH] drm/xe: Fix overflow in guc_ct_snapshot_capture Mika Kuoppala
2026-03-04 16:39 ` Matthew Brost
2026-03-04 18:39   ` Mika Kuoppala
2026-03-04 19:07     ` Matthew Brost
2026-03-04 21:17 ` Mika Kuoppala
2026-03-04 21:37   ` Matthew Brost
2026-03-04 21:46 ` ✓ CI.KUnit: success for " Patchwork
2026-03-05  5:35 ` ✓ Xe.CI.BAT: " Patchwork
2026-03-05 10:59 ` ✗ Xe.CI.FULL: failure " Patchwork
2026-03-05 22:08 ` ✓ CI.KUnit: success for drm/xe: Fix overflow in guc_ct_snapshot_capture (rev2) Patchwork
2026-03-05 22:46 ` ✓ Xe.CI.BAT: " Patchwork
2026-03-06 16:04 ` ✓ Xe.CI.FULL: " Patchwork

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox