drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c:862 amdgpu_gmc_fw_reg_write_reg_wait() error: buffer overflow 'adev->mes.ring' 16 <= u32max

kernel test robot <[email protected]>
Newsgroups dev.linux.lists.oe-kbuild
Message-ID <[email protected]>
BCC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Mukul Joshi <[email protected]>
CC: Alex Deucher <[email protected]>
CC: Alex Sierra <[email protected]>
CC: Michael Chen <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   06cf61899d6498b33e4b7c87d99d5bd471ccc375
commit: b7c4040d0d131de5014fb02bbdbe8fa2b9c5b0b0 drm/amdgpu: Use correct MES pipe in non-SPX mode on GFX 12.1
date:   7 months ago
:::::: branch date: 4 hours ago
:::::: commit date: 7 months ago
config: i386-randconfig-141-20260806 (https://download.01.org/0day-ci/archive/20260809/[email protected]/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: b7c4040d0d13 ("drm/amdgpu: Use correct MES pipe in non-SPX mode on GFX 12.1")
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c:862 amdgpu_gmc_fw_reg_write_reg_wait() error: buffer overflow 'adev->mes.ring' 16 <= u32max

vim +862 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c

e7b90e99fa8fd65 Christian König  2023-09-04  850  
26405ff4306a7be Alex Deucher     2023-12-14  851  void amdgpu_gmc_fw_reg_write_reg_wait(struct amdgpu_device *adev,
26405ff4306a7be Alex Deucher     2023-12-14  852  				      uint32_t reg0, uint32_t reg1,
26405ff4306a7be Alex Deucher     2023-12-14  853  				      uint32_t ref, uint32_t mask,
26405ff4306a7be Alex Deucher     2023-12-14  854  				      uint32_t xcc_inst)
26405ff4306a7be Alex Deucher     2023-12-14  855  {
26405ff4306a7be Alex Deucher     2023-12-14  856  	struct amdgpu_kiq *kiq = &adev->gfx.kiq[xcc_inst];
26405ff4306a7be Alex Deucher     2023-12-14  857  	struct amdgpu_ring *ring = &kiq->ring;
26405ff4306a7be Alex Deucher     2023-12-14  858  	signed long r, cnt = 0;
26405ff4306a7be Alex Deucher     2023-12-14  859  	unsigned long flags;
26405ff4306a7be Alex Deucher     2023-12-14  860  	uint32_t seq;
26405ff4306a7be Alex Deucher     2023-12-14  861  
b7c4040d0d131de Mukul Joshi      2025-08-07 @862  	if (adev->mes.ring[MES_PIPE_INST(xcc_inst, 0)].sched.ready) {
26405ff4306a7be Alex Deucher     2023-12-14  863  		amdgpu_mes_reg_write_reg_wait(adev, reg0, reg1,
d09c7e266c8cd55 Jack Xiao        2024-11-21  864  					      ref, mask, xcc_inst);
26405ff4306a7be Alex Deucher     2023-12-14  865  		return;
26405ff4306a7be Alex Deucher     2023-12-14  866  	}
26405ff4306a7be Alex Deucher     2023-12-14  867  
26405ff4306a7be Alex Deucher     2023-12-14  868  	spin_lock_irqsave(&kiq->ring_lock, flags);
26405ff4306a7be Alex Deucher     2023-12-14  869  	amdgpu_ring_alloc(ring, 32);
26405ff4306a7be Alex Deucher     2023-12-14  870  	amdgpu_ring_emit_reg_write_reg_wait(ring, reg0, reg1,
26405ff4306a7be Alex Deucher     2023-12-14  871  					    ref, mask);
26405ff4306a7be Alex Deucher     2023-12-14  872  	r = amdgpu_fence_emit_polling(ring, &seq, MAX_KIQ_REG_WAIT);
26405ff4306a7be Alex Deucher     2023-12-14  873  	if (r)
26405ff4306a7be Alex Deucher     2023-12-14  874  		goto failed_undo;
26405ff4306a7be Alex Deucher     2023-12-14  875  
26405ff4306a7be Alex Deucher     2023-12-14  876  	amdgpu_ring_commit(ring);
26405ff4306a7be Alex Deucher     2023-12-14  877  	spin_unlock_irqrestore(&kiq->ring_lock, flags);
26405ff4306a7be Alex Deucher     2023-12-14  878  
26405ff4306a7be Alex Deucher     2023-12-14  879  	r = amdgpu_fence_wait_polling(ring, seq, MAX_KIQ_REG_WAIT);
26405ff4306a7be Alex Deucher     2023-12-14  880  
26405ff4306a7be Alex Deucher     2023-12-14  881  	/* don't wait anymore for IRQ context */
26405ff4306a7be Alex Deucher     2023-12-14  882  	if (r < 1 && in_interrupt())
26405ff4306a7be Alex Deucher     2023-12-14  883  		goto failed_kiq;
26405ff4306a7be Alex Deucher     2023-12-14  884  
26405ff4306a7be Alex Deucher     2023-12-14  885  	might_sleep();
19cff16559a4f2d Victor Skvortsov 2024-08-02  886  	while (r < 1 && cnt++ < MAX_KIQ_REG_TRY &&
19cff16559a4f2d Victor Skvortsov 2024-08-02  887  	       !amdgpu_reset_pending(adev->reset_domain)) {
26405ff4306a7be Alex Deucher     2023-12-14  888  
26405ff4306a7be Alex Deucher     2023-12-14  889  		msleep(MAX_KIQ_REG_BAILOUT_INTERVAL);
26405ff4306a7be Alex Deucher     2023-12-14  890  		r = amdgpu_fence_wait_polling(ring, seq, MAX_KIQ_REG_WAIT);
26405ff4306a7be Alex Deucher     2023-12-14  891  	}
26405ff4306a7be Alex Deucher     2023-12-14  892  
26405ff4306a7be Alex Deucher     2023-12-14  893  	if (cnt > MAX_KIQ_REG_TRY)
26405ff4306a7be Alex Deucher     2023-12-14  894  		goto failed_kiq;
26405ff4306a7be Alex Deucher     2023-12-14  895  
26405ff4306a7be Alex Deucher     2023-12-14  896  	return;
26405ff4306a7be Alex Deucher     2023-12-14  897  
26405ff4306a7be Alex Deucher     2023-12-14  898  failed_undo:
26405ff4306a7be Alex Deucher     2023-12-14  899  	amdgpu_ring_undo(ring);
26405ff4306a7be Alex Deucher     2023-12-14  900  	spin_unlock_irqrestore(&kiq->ring_lock, flags);
26405ff4306a7be Alex Deucher     2023-12-14  901  failed_kiq:
26405ff4306a7be Alex Deucher     2023-12-14  902  	dev_err(adev->dev, "failed to write reg %x wait reg %x\n", reg0, reg1);
26405ff4306a7be Alex Deucher     2023-12-14  903  }
26405ff4306a7be Alex Deucher     2023-12-14  904  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.