drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:355 mes_v12_1_remove_hw_queue() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max

BCC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Jack Xiao <[email protected]>
CC: Alex Deucher <[email protected]>
CC: Hawking Zhang <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   6c68fa601b49683ecb04eded993a71dfa8b2ba0b
commit: 75053887d6d8f527578ffcb1113bc336fae49b42 drm/amdgpu/mes12_1: add cooperative dispatch support
date:   8 months ago
:::::: branch date: 13 hours ago
:::::: commit date: 8 months ago
config: i386-randconfig-141-20260806 (https://download.01.org/0day-ci/archive/20260807/[email protected]/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 75053887d6d8 ("drm/amdgpu/mes12_1: add cooperative dispatch support")
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

New smatch warnings:
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:355 mes_v12_1_remove_hw_queue() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max

Old smatch warnings:
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:296 mes_v12_1_add_hw_queue() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1313 mes_v12_1_kiq_enable_queue() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1614 mes_v12_1_kiq_dequeue_sched() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1702 mes_v12_1_kiq_hw_fini() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1705 mes_v12_1_kiq_hw_fini() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1710 mes_v12_1_kiq_hw_fini() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1723 mes_v12_1_xcc_hw_init() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1778 mes_v12_1_xcc_hw_init() error: buffer overflow 'adev->mes.ring' 16 <= s32max

vim +355 drivers/gpu/drm/amd/amdgpu/mes_v12_1.c

e220edf2d6fd6d Jack Xiao 2025-05-14  346  
e220edf2d6fd6d Jack Xiao 2025-05-14  347  static int mes_v12_1_remove_hw_queue(struct amdgpu_mes *mes,
e220edf2d6fd6d Jack Xiao 2025-05-14  348  				     struct mes_remove_queue_input *input)
e220edf2d6fd6d Jack Xiao 2025-05-14  349  {
e220edf2d6fd6d Jack Xiao 2025-05-14  350  	union MESAPI__REMOVE_QUEUE mes_remove_queue_pkt;
75053887d6d8f5 Jack Xiao 2025-03-10  351  	int xcc_id = input->xcc_id;
75053887d6d8f5 Jack Xiao 2025-03-10  352  	int inst = MES_PIPE_INST(xcc_id, AMDGPU_MES_SCHED_PIPE);
75053887d6d8f5 Jack Xiao 2025-03-10  353  
75053887d6d8f5 Jack Xiao 2025-03-10  354  	if (mes->enable_coop_mode)
75053887d6d8f5 Jack Xiao 2025-03-10 @355  		xcc_id = mes->master_xcc_ids[inst];
e220edf2d6fd6d Jack Xiao 2025-05-14  356  
e220edf2d6fd6d Jack Xiao 2025-05-14  357  	memset(&mes_remove_queue_pkt, 0, sizeof(mes_remove_queue_pkt));
e220edf2d6fd6d Jack Xiao 2025-05-14  358  
e220edf2d6fd6d Jack Xiao 2025-05-14  359  	mes_remove_queue_pkt.header.type = MES_API_TYPE_SCHEDULER;
e220edf2d6fd6d Jack Xiao 2025-05-14  360  	mes_remove_queue_pkt.header.opcode = MES_SCH_API_REMOVE_QUEUE;
e220edf2d6fd6d Jack Xiao 2025-05-14  361  	mes_remove_queue_pkt.header.dwsize = API_FRAME_SIZE_IN_DWORDS;
e220edf2d6fd6d Jack Xiao 2025-05-14  362  
e220edf2d6fd6d Jack Xiao 2025-05-14  363  	mes_remove_queue_pkt.doorbell_offset = input->doorbell_offset;
e220edf2d6fd6d Jack Xiao 2025-05-14  364  	mes_remove_queue_pkt.gang_context_addr = input->gang_context_addr;
e220edf2d6fd6d Jack Xiao 2025-05-14  365  
e220edf2d6fd6d Jack Xiao 2025-05-14  366  	return mes_v12_1_submit_pkt_and_poll_completion(mes,
75053887d6d8f5 Jack Xiao 2025-03-10  367  			xcc_id, AMDGPU_MES_SCHED_PIPE,
e220edf2d6fd6d Jack Xiao 2025-05-14  368  			&mes_remove_queue_pkt, sizeof(mes_remove_queue_pkt),
e220edf2d6fd6d Jack Xiao 2025-05-14  369  			offsetof(union MESAPI__REMOVE_QUEUE, api_status));
e220edf2d6fd6d Jack Xiao 2025-05-14  370  }
e220edf2d6fd6d Jack Xiao 2025-05-14  371  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki