AMD General Reviewed-by: Tao Zhou <[email protected]>
> -----Original Message----- > From: Li, Candice <[email protected]> > Sent: Tuesday, May 19, 2026 11:11 AM > To: [email protected] > Cc: Zhang, Hawking <[email protected]>; Zhou1, Tao > <[email protected]>; Yang, Stanley <[email protected]>; Chai, > Thomas <[email protected]>; Li, Candice <[email protected]>; Chai, > Thomas <[email protected]> > Subject: [PATCH v2] drm/amd/ras: bound CPER record fetch buffer size > > Bound CPER record fetch allocation by buffer size. > > v2: Drop redundant cap on cper_num and raise > GET_CPER_RECORD max buffer size. > > Suggested-by: YiPeng Chai <[email protected]> > Signed-off-by: Candice Li <[email protected]> > --- > drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c | 3 ++- > drivers/gpu/drm/amd/ras/rascore/ras_cmd.c | 3 ++- > drivers/gpu/drm/amd/ras/rascore/ras_cmd.h | 3 +++ > 3 files changed, 7 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c > b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c > index 7ec5287daf7f19..0f3e7c40f0dfd5 100644 > --- a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c > +++ b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c > @@ -264,7 +264,8 @@ static int amdgpu_virt_ras_get_cper_records(struct > ras_core_context *ras_core, > if (cmd->input_size != sizeof(struct ras_cmd_cper_record_req)) > return RAS_CMD__ERROR_INVALID_INPUT_SIZE; > > - if (!req->buf_size || !req->buf_ptr || !req->cper_num) > + if (!req->buf_size || !req->buf_ptr || !req->cper_num || > + req->buf_size > RAS_CMD_MAX_CPER_BUF_SZ) > return RAS_CMD__ERROR_INVALID_INPUT_DATA; > > trace = kcalloc(MAX_RECORD_PER_BATCH, sizeof(*trace), > GFP_KERNEL); diff --git a/drivers/gpu/drm/amd/ras/rascore/ras_cmd.c > b/drivers/gpu/drm/amd/ras/rascore/ras_cmd.c > index 4f89810d85a15e..8303aecf91ba71 100644 > --- a/drivers/gpu/drm/amd/ras/rascore/ras_cmd.c > +++ b/drivers/gpu/drm/amd/ras/rascore/ras_cmd.c > @@ -214,7 +214,8 @@ static int ras_cmd_get_cper_records(struct > ras_core_context *ras_core, > if (cmd->input_size != sizeof(struct ras_cmd_cper_record_req)) > return RAS_CMD__ERROR_INVALID_INPUT_SIZE; > > - if (!req->buf_size || !req->buf_ptr || !req->cper_num) > + if (!req->buf_size || !req->buf_ptr || !req->cper_num || > + req->buf_size > RAS_CMD_MAX_CPER_BUF_SZ) > return RAS_CMD__ERROR_INVALID_INPUT_DATA; > > buffer = kzalloc(req->buf_size, GFP_KERNEL); diff --git > a/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h > b/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h > index 7ea35a02898742..a1d4b8b028412b 100644 > --- a/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h > +++ b/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h > @@ -405,6 +405,9 @@ struct batch_ras_trace_info { > > #define RAS_CMD_MAX_BATCH_NUM 300 > #define RAS_CMD_MAX_TRACE_NUM 300 > + > +/* Upper bounds for RAS_CMD__GET_CPER_RECORD to limit kernel > allocations and work. */ > +#define RAS_CMD_MAX_CPER_BUF_SZ (2 * 1024U * 1024U) /* 2 MiB > */ > struct ras_cmd_batch_trace_record_rsp { > uint32_t version; > uint16_t real_batch_num; > -- > 2.25.1
