* [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
[not found] <20260624184444.D4A401F000E9@smtp.kernel.org>
@ 2026-07-08 6:18 ` Pavitra Jha
2026-08-12 9:03 ` kernel test robot
2026-08-12 20:46 ` kernel test robot
0 siblings, 2 replies; 3+ messages in thread
From: Pavitra Jha @ 2026-07-08 6:18 UTC (permalink / raw)
To: alexander.deucher, christian.koenig, airlied, simona
Cc: amd-gfx, dri-devel, linux-kernel, stable, Pavitra Jha
Sashiko AI review of the previous fix flagged three remaining gaps in
the discovery blob parser, all stemming from the same root cause: the
ip_discovery_header pointer itself is constructed from a firmware-
controlled offset with no validation before the cast.
ihdr = (struct ip_discovery_header *)(discovery_bin +
le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
This offset is a firmware-controlled u16 read directly from the
discovery blob's table_list, with no bounds check against
adev->discovery.size before being used to construct ihdr. Every
subsequent read from ihdr, including num_dies and die_info[], is
downstream of this unchecked pointer.
The other two items in that review (unbounded ip_offset advancement
via num_base_address, and num_dies exceeding die_info[]'s capacity)
were already addressed in the previous fix.
Fix by validating the table offset in amdgpu_discovery_get_table_info(),
which is the common path used by all callers except
amdgpu_discovery_read_harvest_bit_per_ip() (which reads
table_list[IP_DISCOVERY].offset directly rather than going through
get_table_info()). Add the equivalent check at that direct access site
as well, so all paths that construct an ip_discovery_header pointer
from a table offset are covered.
The check validates the offset itself against adev->discovery.size,
independent of any specific downstream struct size, since
get_table_info() is shared across ten different table types
(IP_DISCOVERY, HARVEST_INFO, GC, MALL_INFO, VCN_INFO, NPS_INFO, and
others) each with differently-sized table structures.
Fixes: d0c647a6aae2 ("drm/amdgpu/discovery: support new discovery binary header")
Cc: stable@vger.kernel.org
Signed-off-by: Pavitra Jha <jhapavitra98@gmail.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
index b4ee5fc8e..9b55c56cb 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
@@ -564,6 +564,12 @@ static int amdgpu_discovery_get_table_info(struct amdgpu_device *adev,
return -EINVAL;
}
+ if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
+ dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
+ le16_to_cpu((*info)->offset), table_id);
+ return -EINVAL;
+ }
+
return 0;
}
@@ -766,6 +772,14 @@ static void amdgpu_discovery_read_harvest_bit_per_ip(struct amdgpu_device *adev,
int i, j;
bhdr = (struct binary_header *)discovery_bin;
+
+ if (le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset) >=
+ adev->discovery.size) {
+ dev_err(adev->dev, "invalid IP_DISCOVERY table offset %u\n",
+ le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
+ return;
+ }
+
ihdr = (struct ip_discovery_header
*)(discovery_bin +
le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
2026-07-08 6:18 ` [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast Pavitra Jha
@ 2026-08-12 9:03 ` kernel test robot
2026-08-12 20:46 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-08-12 9:03 UTC (permalink / raw)
To: Pavitra Jha, alexander.deucher, christian.koenig, airlied, simona
Cc: oe-kbuild-all, amd-gfx, dri-devel, linux-kernel, stable,
Pavitra Jha
Hi Pavitra,
kernel test robot noticed the following build errors:
[auto build test ERROR on drm-misc/drm-misc-next]
[also build test ERROR on linus/master v7.2-rc7 next-20260810]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Pavitra-Jha/drm-amdgpu-discovery-validate-table-offset-before-IP-discovery-header-cast/20260812-100224
base: https://gitlab.freedesktop.org/drm/misc/kernel.git drm-misc-next
patch link: https://lore.kernel.org/r/20260708061835.111986-1-jhapavitra98%40gmail.com
patch subject: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
config: alpha-allyesconfig (https://download.01.org/0day-ci/archive/20260812/202608121611.JGbGRW2o-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260812/202608121611.JGbGRW2o-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608121611.JGbGRW2o-lkp@intel.com/
All errors (new ones prefixed by >>):
In file included from include/linux/byteorder/little_endian.h:5,
from arch/alpha/include/uapi/asm/byteorder.h:5,
from include/asm-generic/bitops/le.h:6,
from arch/alpha/include/asm/bitops.h:472,
from include/linux/bitops.h:67,
from include/linux/thread_info.h:27,
from include/asm-generic/preempt.h:5,
from ./arch/alpha/include/generated/asm/preempt.h:1,
from include/linux/preempt.h:79,
from include/linux/spinlock.h:56,
from include/linux/mmzone.h:8,
from include/linux/gfp.h:7,
from include/linux/firmware.h:8,
from drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:24:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c: In function 'amdgpu_discovery_verify_npsinfo':
>> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:534:32: error: invalid type argument of '->' (have 'struct table_info')
534 | if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
| ^~
include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu'
37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:534:13: note: in expansion of macro 'le16_to_cpu'
534 | if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
| ^~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:536:44: error: invalid type argument of '->' (have 'struct table_info')
536 | le16_to_cpu((*info)->offset), table_id);
| ^~
include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu'
37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
| ^
include/linux/dev_printk.h:154:9: note: in expansion of macro 'dev_printk_index_wrap'
154 | dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:535:17: note: in expansion of macro 'dev_err'
535 | dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
| ^~~~~~~
In file included from include/linux/device.h:15,
from include/drm/drm_print.h:31,
from drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h:29,
from drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.h:30,
from drivers/gpu/drm/amd/amdgpu/amdgpu.h:37,
from drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:27:
>> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:536:55: error: 'table_id' undeclared (first use in this function); did you mean 'table_info'?
536 | le16_to_cpu((*info)->offset), table_id);
| ^~~~~~~~
include/linux/dev_printk.h:110:37: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:535:17: note: in expansion of macro 'dev_err'
535 | dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
| ^~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:536:55: note: each undeclared identifier is reported only once for each function it appears in
include/linux/dev_printk.h:110:37: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~~~~~~~~~
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:535:17: note: in expansion of macro 'dev_err'
535 | dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
| ^~~~~~~
vim +534 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
508
509 static int amdgpu_discovery_verify_npsinfo(struct amdgpu_device *adev,
510 struct table_info *info)
511 {
512 uint8_t *discovery_bin = adev->discovery.bin;
513 uint16_t checksum;
514 uint16_t offset;
515
516 offset = le16_to_cpu(info->offset);
517 checksum = le16_to_cpu(info->checksum);
518
519 struct nps_info_header *nhdr =
520 (struct nps_info_header *)(discovery_bin + offset);
521
522 if (le32_to_cpu(nhdr->table_id) != NPS_INFO_TABLE_ID) {
523 dev_dbg(adev->dev, "invalid ip discovery nps info table id\n");
524 return -EINVAL;
525 }
526
527 if (!amdgpu_discovery_verify_checksum(adev, discovery_bin + offset,
528 le32_to_cpu(nhdr->size_bytes),
529 checksum)) {
530 dev_dbg(adev->dev, "invalid nps info data table checksum\n");
531 return -EINVAL;
532 }
533
> 534 if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
535 dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
> 536 le16_to_cpu((*info)->offset), table_id);
537 return -EINVAL;
538 }
539
540 return 0;
541 }
542
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
2026-07-08 6:18 ` [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast Pavitra Jha
2026-08-12 9:03 ` kernel test robot
@ 2026-08-12 20:46 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-08-12 20:46 UTC (permalink / raw)
To: Pavitra Jha, alexander.deucher, christian.koenig, airlied, simona
Cc: llvm, oe-kbuild-all, amd-gfx, dri-devel, linux-kernel, stable,
Pavitra Jha
Hi Pavitra,
kernel test robot noticed the following build errors:
[auto build test ERROR on drm-misc/drm-misc-next]
[also build test ERROR on linus/master v7.2-rc7 next-20260811]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Pavitra-Jha/drm-amdgpu-discovery-validate-table-offset-before-IP-discovery-header-cast/20260812-100224
base: https://gitlab.freedesktop.org/drm/misc/kernel.git drm-misc-next
patch link: https://lore.kernel.org/r/20260708061835.111986-1-jhapavitra98%40gmail.com
patch subject: [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20260813/202608130435.5Msck82Q-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 12df34b8469b8095359de8c249cb1b2753fadeea)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260813/202608130435.5Msck82Q-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608130435.5Msck82Q-lkp@intel.com/
All errors (new ones prefixed by >>):
>> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:534:25: error: member reference type 'struct table_info' is not a pointer; did you mean to use '.'?
534 | if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
| ~~~~~~~^~
| .
include/linux/byteorder/generic.h:91:21: note: expanded from macro 'le16_to_cpu'
91 | #define le16_to_cpu __le16_to_cpu
| ^
include/uapi/linux/byteorder/little_endian.h:37:51: note: expanded from macro '__le16_to_cpu'
37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
| ^
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:536:23: error: member reference type 'struct table_info' is not a pointer; did you mean to use '.'?
536 | le16_to_cpu((*info)->offset), table_id);
| ~~~~~~~^~
| .
include/linux/dev_printk.h:154:65: note: expanded from macro 'dev_err'
154 | dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
include/linux/dev_printk.h:110:23: note: expanded from macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~~~~~~~~~
include/uapi/linux/byteorder/little_endian.h:37:51: note: expanded from macro '__le16_to_cpu'
37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x))
| ^
>> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:536:34: error: use of undeclared identifier 'table_id'
536 | le16_to_cpu((*info)->offset), table_id);
| ^~~~~~~~
3 errors generated.
vim +534 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
508
509 static int amdgpu_discovery_verify_npsinfo(struct amdgpu_device *adev,
510 struct table_info *info)
511 {
512 uint8_t *discovery_bin = adev->discovery.bin;
513 uint16_t checksum;
514 uint16_t offset;
515
516 offset = le16_to_cpu(info->offset);
517 checksum = le16_to_cpu(info->checksum);
518
519 struct nps_info_header *nhdr =
520 (struct nps_info_header *)(discovery_bin + offset);
521
522 if (le32_to_cpu(nhdr->table_id) != NPS_INFO_TABLE_ID) {
523 dev_dbg(adev->dev, "invalid ip discovery nps info table id\n");
524 return -EINVAL;
525 }
526
527 if (!amdgpu_discovery_verify_checksum(adev, discovery_bin + offset,
528 le32_to_cpu(nhdr->size_bytes),
529 checksum)) {
530 dev_dbg(adev->dev, "invalid nps info data table checksum\n");
531 return -EINVAL;
532 }
533
> 534 if (le16_to_cpu((*info)->offset) >= adev->discovery.size) {
535 dev_err(adev->dev, "invalid table offset %u for table_id %u\n",
> 536 le16_to_cpu((*info)->offset), table_id);
537 return -EINVAL;
538 }
539
540 return 0;
541 }
542
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-12 20:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260624184444.D4A401F000E9@smtp.kernel.org>
2026-07-08 6:18 ` [PATCH v2] drm/amdgpu/discovery: validate table offset before IP discovery header cast Pavitra Jha
2026-08-12 9:03 ` kernel test robot
2026-08-12 20:46 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).