[agd5f:drm-next-7.3 220/308] drivers/gpu/drm/amd/amdgpu/../ras/core/cmd.c:336 ras_cmd_get_batch_trace_records() error: buffer overflow 'output_data->records' 300 <= 2147483646
kernel test robot <[email protected]>
| Newsgroups | dev.linux.lists.oe-kbuild |
|---|---|
| Message-ID | <[email protected]> |
BCC: [email protected] CC: [email protected] TO: YiPeng Chai <[email protected]> CC: Alex Deucher <[email protected]> CC: Hawking Zhang <[email protected]> Hi YiPeng, First bad commit (maybe != root cause): tree: https://gitlab.freedesktop.org/agd5f/linux.git drm-next-7.3 head: daaeec235e46b45a0dbd4facfb275cc43022028d commit: d95700604fbc6fd7534303796d005e6efbd1d591 [220/308] drm/amd/ras: rename core ras_* files and update include guards :::::: branch date: 5 days ago :::::: commit date: 5 days ago config: x86_64-randconfig-161-20260810 (https://download.01.org/0day-ci/archive/20260811/[email protected]/config) compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211) smatch: v0.5.0-9187-g5189e3fb If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <[email protected]> | Reported-by: Dan Carpenter <[email protected]> | Closes: https://lore.kernel.org/r/[email protected]/ smatch warnings: drivers/gpu/drm/amd/amdgpu/../ras/core/cmd.c:336 ras_cmd_get_batch_trace_records() error: buffer overflow 'output_data->records' 300 <= 2147483646 vim +336 drivers/gpu/drm/amd/amdgpu/../ras/core/cmd.c 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 291 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 292 static int ras_cmd_get_batch_trace_records(struct ras_core_context *ras_core, 4c74635afdceff drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-09-25 293 struct ras_cmd_ctx *cmd, void *data) 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 294 { 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 295 struct ras_cmd_batch_trace_record_req *input_data = 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 296 (struct ras_cmd_batch_trace_record_req *)cmd->input_buff_raw; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 297 struct ras_cmd_batch_trace_record_rsp *output_data = 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 298 (struct ras_cmd_batch_trace_record_rsp *)cmd->output_buff_raw; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 299 struct ras_log_batch_overview overview; 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 300 struct ras_log_info *trace_arry = NULL; 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 301 uint32_t trace_count = MAX_RECORD_PER_BATCH; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 302 struct ras_log_info *record; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 303 int i, j, count = 0, offset = 0; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 304 uint64_t id; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 305 bool completed = false; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 306 2206e6c76d05e3 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 307 if ((cmd->input_size != sizeof(struct ras_cmd_batch_trace_record_req)) || 2206e6c76d05e3 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 308 (cmd->output_buf_size < sizeof(*output_data))) 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 309 return RAS_CMD__ERROR_INVALID_INPUT_SIZE; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 310 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 311 if ((!input_data->batch_num) || (input_data->batch_num > RAS_CMD_MAX_BATCH_NUM)) 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 312 return RAS_CMD__ERROR_INVALID_INPUT_DATA; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 313 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 314 ras_log_ring_get_batch_overview(ras_core, &overview); 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 315 if ((input_data->start_batch_id < overview.first_batch_id) || 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 316 (input_data->start_batch_id >= overview.last_batch_id)) 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 317 return RAS_CMD__ERROR_INVALID_INPUT_SIZE; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 318 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 319 trace_arry = kcalloc(trace_count, sizeof(*trace_arry), GFP_KERNEL); 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 320 if (!trace_arry) 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 321 return RAS_CMD__ERROR_GENERIC; 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 322 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 323 for (i = 0; i < input_data->batch_num; i++) { 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 324 id = input_data->start_batch_id + i; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 325 if (id >= overview.last_batch_id) { 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 326 completed = true; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 327 break; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 328 } 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 329 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 330 count = ras_log_ring_get_batch_records(ras_core, 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 331 id, trace_arry, trace_count); 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 332 if (count > 0) { 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 333 if ((offset + count) > RAS_CMD_MAX_TRACE_NUM) 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 334 break; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 335 for (j = 0; j < count; j++) { 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 @336 record = &output_data->records[offset + j]; 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 337 record->seqno = trace_arry[j].seqno; 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 338 record->timestamp = trace_arry[j].timestamp; 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 339 record->event = trace_arry[j].event; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 340 memcpy(&record->aca_reg, 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 341 &trace_arry[j].aca_reg, sizeof(trace_arry[j].aca_reg)); 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 342 } 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 343 } else { 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 344 count = 0; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 345 } 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 346 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 347 output_data->batchs[i].batch_id = id; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 348 output_data->batchs[i].offset = offset; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 349 output_data->batchs[i].trace_num = count; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 350 offset += count; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 351 } 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 352 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 353 output_data->start_batch_id = input_data->start_batch_id; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 354 output_data->real_batch_num = i; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 355 output_data->remain_num = completed ? 0 : (input_data->batch_num - i); 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 356 output_data->version = 0; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 357 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 358 cmd->output_size = sizeof(struct ras_cmd_batch_trace_record_rsp); 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 359 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 360 kfree(trace_arry); 90b0cbcba1bd68 drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2026-05-19 361 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 362 return RAS_CMD__SUCCESS; 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 363 } 19030244e1f99f drivers/gpu/drm/amd/ras/rascore/ras_cmd.c YiPeng Chai 2025-03-17 364 :::::: The code at line 336 was first introduced by commit :::::: 19030244e1f99f3e9f8617ba4cb90ce49276eab0 drm/amd/ras: Add ras ioctl command handler :::::: TO: YiPeng Chai <[email protected]> :::::: CC: Alex Deucher <[email protected]> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki