drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:883 mes_v12_1_inv_tlbs_pasid() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max

BCC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Shaoyun Liu <[email protected]>
CC: Alex Deucher <[email protected]>
CC: Prike Liang <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   06cf61899d6498b33e4b7c87d99d5bd471ccc375
commit: d0c989a0aad3ff047b72c89c91969a535f72dd2e drm/amd/amdgpu : Use the MES INV_TLBS API for tlb invalidation on gfx12_1
date:   7 months ago
:::::: branch date: 9 hours ago
:::::: commit date: 7 months ago
config: i386-randconfig-141-20260806 (https://download.01.org/0day-ci/archive/20260809/[email protected]/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: d0c989a0aad3 ("drm/amd/amdgpu : Use the MES INV_TLBS API for tlb invalidation on gfx12_1")
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

New smatch warnings:
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:883 mes_v12_1_inv_tlbs_pasid() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max

Old smatch warnings:
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:288 mes_v12_1_add_hw_queue() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:349 mes_v12_1_remove_hw_queue() error: buffer overflow 'mes->master_xcc_ids' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1382 mes_v12_1_kiq_enable_queue() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1680 mes_v12_1_kiq_dequeue_sched() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1768 mes_v12_1_kiq_hw_fini() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1771 mes_v12_1_kiq_hw_fini() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1776 mes_v12_1_kiq_hw_fini() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1828 mes_v12_1_xcc_hw_init() error: buffer overflow 'adev->mes.ring' 16 <= s32max
drivers/gpu/drm/amd/amdgpu/mes_v12_1.c:1886 mes_v12_1_xcc_hw_init() error: buffer overflow 'adev->mes.ring' 16 <= s32max

vim +883 drivers/gpu/drm/amd/amdgpu/mes_v12_1.c

d0c989a0aad3ff Shaoyun Liu 2025-07-31  873  
d0c989a0aad3ff Shaoyun Liu 2025-07-31  874  static int mes_v12_1_inv_tlbs_pasid(struct amdgpu_mes *mes,
d0c989a0aad3ff Shaoyun Liu 2025-07-31  875  				    struct mes_inv_tlbs_pasid_input *input)
d0c989a0aad3ff Shaoyun Liu 2025-07-31  876  {
d0c989a0aad3ff Shaoyun Liu 2025-07-31  877  	union MESAPI__INV_TLBS mes_inv_tlbs;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  878  	int xcc_id = input->xcc_id;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  879  	int inst = MES_PIPE_INST(xcc_id, AMDGPU_MES_SCHED_PIPE);
d0c989a0aad3ff Shaoyun Liu 2025-07-31  880  	int ret;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  881  
d0c989a0aad3ff Shaoyun Liu 2025-07-31  882  	if (mes->enable_coop_mode)
d0c989a0aad3ff Shaoyun Liu 2025-07-31 @883  		xcc_id = mes->master_xcc_ids[inst];
d0c989a0aad3ff Shaoyun Liu 2025-07-31  884  
d0c989a0aad3ff Shaoyun Liu 2025-07-31  885  	memset(&mes_inv_tlbs, 0, sizeof(mes_inv_tlbs));
d0c989a0aad3ff Shaoyun Liu 2025-07-31  886  
d0c989a0aad3ff Shaoyun Liu 2025-07-31  887  	mes_inv_tlbs.header.type = MES_API_TYPE_SCHEDULER;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  888  	mes_inv_tlbs.header.opcode = MES_SCH_API_INV_TLBS;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  889  	mes_inv_tlbs.header.dwsize = API_FRAME_SIZE_IN_DWORDS;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  890  
d0c989a0aad3ff Shaoyun Liu 2025-07-31  891  	mes_inv_tlbs.invalidate_tlbs.inv_sel = 0;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  892  	mes_inv_tlbs.invalidate_tlbs.flush_type = input->flush_type;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  893  	mes_inv_tlbs.invalidate_tlbs.inv_sel_id = input->pasid;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  894  
d0c989a0aad3ff Shaoyun Liu 2025-07-31  895  	/*convert amdgpu_mes_hub_id to mes expected hub_id */
d0c989a0aad3ff Shaoyun Liu 2025-07-31  896  	ret = mes_v12_inv_tlb_convert_hub_id(input->hub_id);
d0c989a0aad3ff Shaoyun Liu 2025-07-31  897  	if (ret < 0)
d0c989a0aad3ff Shaoyun Liu 2025-07-31  898  		return -EINVAL;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  899  	mes_inv_tlbs.invalidate_tlbs.hub_id = ret;
d0c989a0aad3ff Shaoyun Liu 2025-07-31  900  	return mes_v12_1_submit_pkt_and_poll_completion(mes, xcc_id, AMDGPU_MES_KIQ_PIPE,
d0c989a0aad3ff Shaoyun Liu 2025-07-31  901  			&mes_inv_tlbs, sizeof(mes_inv_tlbs),
d0c989a0aad3ff Shaoyun Liu 2025-07-31  902  			offsetof(union MESAPI__INV_TLBS, api_status));
d0c989a0aad3ff Shaoyun Liu 2025-07-31  903  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki