[SRU][N][PATCH 0/3] UBSAN: array-index-out-of-bounds in /build/linux-Z1RxaK/linux-6.8.0/drivers/gpu/drm/amd/amdgpu/../pm/powerplay/hwmgr/processpptables.c:1249:61 (LP: #2078041)

[Juerg Haefliger]

BugLink: https://bugs.launchpad.net/bugs/2078041

[Impact]

[   38.630689] ------------[ cut here ]------------
[   38.630701] UBSAN: array-index-out-of-bounds in /build/linux-Z1RxaK/linux-6.8.0/drivers/gpu/drm/amd/amdgpu/../pm/powerplay/hwmgr/processpptables.c:1249:61
[   38.630714] index 1 is out of range for type 'ATOM_PPLIB_VCE_Clock_Voltage_Limit_Record [1]'
[   38.630722] CPU: 1 PID: 459 Comm: (udev-worker) Not tainted 6.8.0-41-generic #41-Ubuntu
[   38.630730] Hardware name: HP HP Laptop 17-ca0xxx/84D0, BIOS F.66 11/27/2023
[   38.630734] Call Trace:
[   38.630739]  <TASK>
[   38.630745]  dump_stack_lvl+0x76/0xa0
[   38.630763]  dump_stack+0x10/0x20
[   38.630770]  __ubsan_handle_out_of_bounds+0xc6/0x110
[   38.630782]  init_clock_voltage_dependency+0xa19/0xac0 [amdgpu]
[   38.631592]  pp_tables_initialize+0x116/0x440 [amdgpu]
[   38.631592]  hwmgr_hw_init+0x7b/0x1e0 [amdgpu]
[   38.631592]  pp_hw_init+0x16/0x50 [amdgpu]
[   38.631592]  amdgpu_device_ip_init+0x49c/0x860 [amdgpu]
[   38.631592]  amdgpu_device_init+0x9b3/0x1180 [amdgpu]
[   38.631592]  amdgpu_driver_load_kms+0x1a/0x1c0 [amdgpu]
[   38.631592]  amdgpu_pci_probe+0x1c1/0x600 [amdgpu]
[   38.631592]  local_pci_probe+0x47/0xb0
[   38.631592]  pci_call_probe+0x55/0x1a0
[   38.631592]  pci_device_probe+0x84/0x120
[   38.631592]  really_probe+0x1c7/0x410
[   38.631592]  __driver_probe_device+0x8c/0x180
[   38.631592]  driver_probe_device+0x24/0xd0
[   38.631592]  __driver_attach+0x10b/0x210
[   38.631592]  ? __pfx___driver_attach+0x10/0x10
[   38.631592]  bus_for_each_dev+0x8d/0xf0
[   38.631592]  driver_attach+0x1e/0x30
[   38.631592]  bus_add_driver+0x156/0x260
[   38.631592]  driver_register+0x5e/0x130
[   38.631592]  ? __pfx_amdgpu_init+0x10/0x10 [amdgpu]
[   38.631592]  __pci_register_driver+0x5e/0x70
[   38.631592]  amdgpu_init+0x69/0xff0 [amdgpu]
[   38.631592]  do_one_initcall+0x5e/0x340
[   38.631592]  do_init_module+0x97/0x290
[   38.631592]  load_module+0xba1/0xcf0
[   38.631592]  init_module_from_file+0x96/0x100
[   38.631592]  ? init_module_from_file+0x96/0x100
[   38.631592]  idempotent_init_module+0x11c/0x2b0
[   38.631592]  __x64_sys_finit_module+0x64/0xd0
[   38.631592]  x64_sys_call+0x1d6e/0x25c0
[   38.631592]  do_syscall_64+0x7f/0x180
[   38.631592]  ? syscall_exit_to_user_mode+0x89/0x260
[   38.631592]  ? do_syscall_64+0x8c/0x180
[   38.631592]  ? __seccomp_filter+0x368/0x570
[   38.631592]  ? do_sys_openat2+0x9f/0xe0
[   38.631592]  ? ext4_llseek+0xc3/0x130
[   38.631592]  ? ksys_lseek+0x80/0xd0
[   38.631592]  ? syscall_exit_to_user_mode+0x89/0x260
[   38.631592]  ? do_syscall_64+0x8c/0x180
[   38.631592]  ? do_syscall_64+0x8c/0x180
[   38.631592]  ? do_syscall_64+0x8c/0x180
[   38.631592]  ? irqentry_exit_to_user_mode+0x7e/0x260
[   38.631592]  ? irqentry_exit+0x43/0x50
[   38.631592]  entry_SYSCALL_64_after_hwframe+0x78/0x80
[   38.631592] RIP: 0033:0x77a78712725d
[   38.631592] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8b bb 0d 00 f7 d8 64 89 01 48
[   38.631592] RSP: 002b:00007ffd96dace28 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[   38.631592] RAX: ffffffffffffffda RBX: 0000650a3a770990 RCX: 000077a78712725d
[   38.631592] RDX: 0000000000000004 RSI: 000077a78742a07d RDI: 0000000000000021
[   38.631592] RBP: 00007ffd96dacee0 R08: 0000000000000040 R09: 00007ffd96dace70
[   38.631592] R10: 000077a787203b20 R11: 0000000000000246 R12: 000077a78742a07d
[   38.631592] R13: 0000000000020000 R14: 0000650a3a770010 R15: 0000650a3a773c10
[   38.631592]  </TASK>
[   38.652542] ---[ end trace ]---

[Test Case]

Compile-tested only.

[Where Problems Could Occur]

Limited to AMD GPU drivers, so people with that HW might encounter any type of issues.

[Notes]

Trace is from dmesg in bug 2077920.

Alex Deucher (2):
  drm/amdgpu/pptable: convert some variable sized arrays to [] style
  drm/amdgpu: convert some variable sized arrays to [] style

Tasos Sahanidis (1):
  drm/amdgpu/pptable: Fix UBSAN array-index-out-of-bounds

 drivers/gpu/drm/amd/include/pptable.h | 91 ++++++++++++++-------------
 1 file changed, 49 insertions(+), 42 deletions(-)

-- 
2.43.0