Re: [PATCH v4 02/12] drm/xe/cper: Retrieve the error counter record for CPER reporting

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/xe: out-of-bounds array access on informational or reserved RAS errors
--

commit 27317cc719f71d74be0f7fcd94c5a8fbf53f9e5e
Author: Badal Nilawar <badal.nilawar@intel.com>

drm/xe/cper: Retrieve the error counter record for CPER reporting
    
Retrieve error counter record required to build a CPER record.

> diff --git a/drivers/gpu/drm/xe/xe_ras.c b/drivers/gpu/drm/xe/xe_ras.c
> index 7a85735c57d58..5cfc9beff8c13 100644
> --- a/drivers/gpu/drm/xe/xe_ras.c
> +++ b/drivers/gpu/drm/xe/xe_ras.c
[ ... ]
> @@ -284,21 +282,21 @@ static void ras_send_error_event(struct xe_device *xe, u8 severity, u8 component)
>  {
>  	struct xe_ras_error_class counter = {0};
> +	struct xe_ras_get_counter_response response = {0};
>  	u8 drm_severity, drm_component;
> -	u32 value;
>  	int ret;
>  
>  	counter.common.severity = severity;
>  	counter.common.component = component;
>  
> -	ret = get_counter(xe, &counter, &value);
> +	ret = xe_ras_get_counter_response(xe, &counter, &response);
>  	if (ret)
>  		return;
>  
>  	drm_severity = xe_to_drm_ras_severity(severity);
>  	drm_component = xe_to_drm_ras_component(component);
>  
> -	xe_drm_ras_event(xe, drm_component, drm_severity, value);
> +	xe_drm_ras_event(xe, drm_component, drm_severity, response.value);

[Severity: High]
When firmware returns valid but unmapped values, like 
XE_RAS_SEV_INFORMATIONAL or XE_RAS_COMP_RESERVED, is it possible that 
xe_to_drm_ras_severity() and xe_to_drm_ras_component() will map these to 
their MAX values (DRM_XE_RAS_ERR_SEV_MAX and DRM_XE_RAS_ERR_COMP_MAX)?

If so, does this call to xe_drm_ras_event() cause out-of-bounds array
accesses? 

In drivers/gpu/drm/xe/xe_drm_ras.c:xe_drm_ras_event():

    struct xe_drm_ras_counter *info = ras->info[severity];
    ...
    node = &ras->node[severity];

    if (!info || !info[component].name)
        return;

Since the arrays are sized for the valid drm enum mappings, using the MAX
values as indices would lead to wild pointer dereferences.

>  }
>  
>  static u8 handle_core_compute_errors(struct xe_ras_error_array *arr)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009104602.1075405-14-badal.nilawar@intel.com?part=2