- There is a bug that the PF's RAS trace_num may access out of bound memory from the VF size
- Must move the iterator to a dedicated variable and add a boundary check Signed-off-by: Bokun Zhang <[email protected]> --- drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c index e73443b933dc..c6e7aa6ecb8f 100644 --- a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c +++ b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c @@ -205,6 +205,8 @@ static int amdgpu_virt_ras_get_batch_records(struct ras_core_context *ras_core, }; struct ras_cmd_batch_trace_record_rsp *rsp = rsp_cache; struct batch_ras_trace_info *batch; + uint32_t trace_num; + uint32_t offset; int ret = 0; uint32_t i; @@ -222,10 +224,14 @@ static int amdgpu_virt_ras_get_batch_records(struct ras_core_context *ras_core, if (batch_id != batch->batch_id) return -ENODATA; - for (i = 0; i < batch->trace_num; i++) { + trace_num = batch->trace_num; + offset = batch->offset; + for (i = 0; i < trace_num; i++) { if (i >= arr_num) break; - trace_arr[i] = &rsp->records[batch->offset + i]; + if ((offset + i) >= RAS_CMD_MAX_TRACE_NUM) + break; + trace_arr[i] = &rsp->records[offset + i]; } return i; -- 2.51.0
