Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <8bca88b8-e7cb-8458-01e9-544de44302b8@amd.com>
Date:   Fri, 4 Nov 2022 16:40:52 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.2.2
Subject: Re: Coverity: kfd_parse_subtype_cache(): Memory - corruptions
Content-Language: en-US
To:     coverity-bot <keescook@chromium.org>,
        Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>,
        "Ma, Jun" <Jun.Ma2@amd.com>
Cc:     Alex Deucher <alexander.deucher@amd.com>,
        =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>,
        David Airlie <airlied@gmail.com>,
        amd-gfx@lists.freedesktop.org, Oded Gabbay <oded.gabbay@gmail.com>,
        Jay Cornwall <Jay.Cornwall@amd.com>, Ben Goz <ben.goz@amd.com>,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
        Kent Russell <kent.russell@amd.com>,
        "Pan, Xinhui" <Xinhui.Pan@amd.com>,
        Daniel Vetter <daniel@ffwll.ch>, Amber Lin <Amber.Lin@amd.com>,
        "Gustavo A. R. Silva" <gustavo@embeddedor.com>,
        linux-next@vger.kernel.org, linux-hardening@vger.kernel.org
References: <202211041239.2B98F280@keescook>
From:   Felix Kuehling <felix.kuehling@amd.com>
Organization: AMD Inc.
In-Reply-To: <202211041239.2B98F280@keescook>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?cnV6N2FOOU1tWWJuSmhvMnJzcEtnYUc0YWFOUUkxNWc0ZCt5eEk1L2JUdE5a?=
 =?utf-8?B?bUYxams4MXd1Zzk3VUtLeTZTTmZyWVBBYmhQSFpBMWgxdUE0cU4xTTAvZ3ZQ?=
 =?utf-8?B?MnUzYW9iNG9DTlVFWUhDdzdUdFkwaURLUGlzSmVsd0VDZzVhWDNVYThHZkR6?=
 =?utf-8?B?amRucDJJeFJtVXpxVlNCK05jdm05UnVaUFQ4SDR0M3A4TVplUkltR25uTTkw?=
 =?utf-8?B?Y2RURlEwdTBmQXRUVGViYWgyZVFvWi9QSXIyN1U5cHR6aUpST0ljYnJSb3lh?=
 =?utf-8?B?N3dvd0xUbGV5eFJlOUxuVGJGNFVmRVgxcFhHYWtjMXdEdm9tN2pwZnBHU0hj?=
 =?utf-8?B?ZHZlZVViVWhhK09mR21YQzkwSStsdjhyTmhIc04yY2JUdmZQRTVaS0Z5eXd5?=
 =?utf-8?B?Mll2MkVvdjg3dC9ONFVjMHZzc3IrTHZscFYvUkhnZkRSUlBiS0ZmdldjSmxF?=
 =?utf-8?B?ZDBQNjNIUlpWSG1nUDNXUGdVRWNQUHZFL0M1ck9nTWlEU0VrY2RRNm1idGFk?=
 =?utf-8?B?RG5VUHNwbzF3cXBMSGtYdkRZZCt3UFpQMGlnYWIwQzRaQ2IwcDJXaHpiTkRj?=
 =?utf-8?B?azZUbkFPMFRxZ3JBaVFvdGpNZCswOUhCcytZVVMwd28vc3A0NnMxQkJvTG1O?=
 =?utf-8?B?YlBxV3VXcnFjNTA2QTI0eEQrd3BGL1dqOUE3ZlFHYldrYU1CZFAwbUdxWG9M?=
 =?utf-8?B?Y0JLWXpUeE5ObCtxbVJqeUJ1Rm1wQkg5Z1NieWpnbzNUaWw2NUJKekZYb2lt?=
 =?utf-8?B?TWNLbXdMQ0t6KzVJTTBhdS9oU3lmcGpqMGN2Z1RlWkJrcWxXaGU0bk94cDV2?=
 =?utf-8?B?bjd6dkg5dUhrTVI4SkorOE5rS1pWdldVcjhWMHJydHB3R3JISXY4YW9QeGNV?=
 =?utf-8?B?Y2IrT1JydXl0a3hsbDQ5VHF5dlZLVWorOHZ3REkvNXNZTW1tNzdvUm1yMkZV?=
 =?utf-8?B?UWVqNWNRbkVoeWVGWUMvb3RWcENsT2RQNDd3SU52MTJSU1VvNi9seDd5S2J2?=
 =?utf-8?B?SCtvT1krdHYwWGJpRWsvTFJJeUR2NzJxTStNL2psMG9UZCtwNnBZZWFTdW1P?=
 =?utf-8?B?a3R1cW9INnRueDRvQ3FyWDJ1blR6bnpNZ1ZtVEZncmVFQjJ0dDYwS0lLS0F5?=
 =?utf-8?B?ZTF6K1hqQ1k2d0lLUzdyMm0yZDJnQ0puK2N5OVBueTk1RnRzdTVrbllDWC9r?=
 =?utf-8?B?QnNLOXJST1ptbFVwWlZPVnBraGsrb1FZTmxRRTdRb05Lbk1oTFJhQ1IwNzQz?=
 =?utf-8?B?S1JZL0NIMnltN3QvZkc5ZEdiU0x3Q1EvVWNZbGpUWHQveXlOcUpMRVJtNC9G?=
 =?utf-8?B?UTBYQ05JNU1hY0VWQ2hZQWJLWTV1Vmh2QXpIZm5EeWtZbDlBS214YUwwNUlw?=
 =?utf-8?B?VzVTUFUxdFdpUnhCVHJ1TU5mUUNrYlM5VkZ5U3FnZXBva2xRbGJSVzA4a1Ra?=
 =?utf-8?B?K09Ib01kcllKMVhlQkJsSHFHc1BGd2ZrWk14MWlacERqenlsemRmZmw1djA2?=
 =?utf-8?B?YUdONHkxNnhJWlZnUmNRc3p6WCtHT0JvR2tsbVNQK3dRZWtXdEpiSENLR3hI?=
 =?utf-8?B?UEhZdU9iZms3VFBPeGlXWVRpd3g4MTN1NHFrMUpHb20yNVYzMXArRWVIK1gx?=
 =?utf-8?B?cHhDS3Y2NVhBRTJyV29IOWpCUE1UUUE2VitLSldtZVJaaGFoWDhQV2NCWmtx?=
 =?utf-8?B?a0UxWmVQWGo3TGVxaVZ5MzlDVy84ZkJxUmpaaFhSVldXdjhUb3h4NTZWNGRS?=
 =?utf-8?B?bDNXVlZHeG9kYmo5bWdGMHVuL2RvYW1pOVRvNzdybXZOUE5UWFJKMmpPdUZy?=
 =?utf-8?B?L2ZDU1NWUGVBYk56V1dQUjRxVVZjd2M1UE9LdDQzZWlLMHJrS1RGS29VVE9z?=
 =?utf-8?B?dmJ6dlBkZlVtK3pBbkY1ZlZEZkU0cWp5YmtpWjhtWHVKSDhUL2NnM1hqU2Ry?=
 =?utf-8?B?WGxuZEtiSTZVVE81eDFWRC9kYTM2VnZDZk1IU3RaaDBHWnVDRnNRMXJ5bnI4?=
 =?utf-8?B?azlLNGw1QkZEaTUyUnBRNk9FSTdvYXRFK3JkNXpnL04rS3FkTjZsTHp6Rk9C?=
 =?utf-8?B?N1pPK0pxVk43R0h3QmUwbm56aDhTdEJ2VkdYRnBDdXl6eVlTRDU1eDZQOXRp?=
 =?utf-8?Q?h511NYdFaeMhGxmgiYE4FtTdh?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d07c513a-f7e9-4f4b-4f8f-08dabea4deec
X-MS-Exchange-CrossTenant-AuthSource: BN9PR12MB5115.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Nov 2022 20:40:55.2007
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: JBtH/OOIwZBppAhswGrWjs0vfVKfkdzaNbDzarqWqlG6JUwKne2MKSxiSEL8Sp3ao9fggRmw5BoY2rNuZsH/EQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5995
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 2022-11-04 15:41, coverity-bot wrote:
> Hello!
>
> This is an experimental semi-automated report about issues detected by
> Coverity from a scan of next-20221104 as part of the linux-next scan project:
> https://scan.coverity.com/projects/linux-next-weekly-scan
>
> You're getting this email because you were associated with the identified
> lines of code (noted below) that were touched by commits:
>
>    Fri Dec 8 23:08:59 2017 -0500
>      3a87177eb141 ("drm/amdkfd: Add topology support for dGPUs")
>
> Coverity reported the following:
>
> *** CID 1527133:  Memory - corruptions  (OVERRUN)
> drivers/gpu/drm/amd/amdkfd/kfd_crat.c:1113 in kfd_parse_subtype_cache()
> 1107     			props->cache_size = cache->cache_size;
> 1108     			props->cacheline_size = cache->cache_line_size;
> 1109     			props->cachelines_per_tag = cache->lines_per_tag;
> 1110     			props->cache_assoc = cache->associativity;
> 1111     			props->cache_latency = cache->cache_latency;
> 1112
> vvv     CID 1527133:  Memory - corruptions  (OVERRUN)
> vvv     Overrunning array "cache->sibling_map" of 32 bytes by passing it to a function which accesses it at byte offset 63 using argument "64UL". [Note: The source code implementation of the function has been overridden by a builtin model.]
> 1113     			memcpy(props->sibling_map, cache->sibling_map,
> 1114     					sizeof(props->sibling_map));
> 1115
> 1116     			/* set the sibling_map_size as 32 for CRAT from ACPI */
> 1117     			props->sibling_map_size = CRAT_SIBLINGMAP_SIZE;
> 1118
>
> If this is a false positive, please let us know so we can mark it as
> such, or teach the Coverity rules to be smarter. If not, please make
> sure fixes get into linux-next. :) For patches fixing this, please
> include these lines (but double-check the "Fixes" first):
>
> Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
> Addresses-Coverity-ID: 1527133 ("Memory - corruptions")
> Fixes: 3a87177eb141 ("drm/amdkfd: Add topology support for dGPUs")
>
> I'm not sure why this suddenly appeared after 5 years, but the read
> over-run looks legit:


I think this was introduced by a more recent patch that was in fact 
meant to fix an array overrun on HW that is outgrowing the CRAT sibling 
map size:

> commit 0938fbeb6f53fc44bc9b19784dee28496e68ba0c
> Author: Ma Jun <Jun.Ma2@amd.com>
> Date:   Wed Nov 2 15:53:26 2022 +0800
>
>     drm/amdkfd: Fix the warning of array-index-out-of-bounds
>
>     For some GPUs with more CUs, the original sibling_map[32]
>     in struct crat_subtype_cache is not enough
>     to save the cache information when create the VCRAT table,
>     so skip filling the struct crat_subtype_cache info instead
>     fill struct kfd_cache_properties directly to fix this problem.
>
>     Signed-off-by: Ma Jun <Jun.Ma2@amd.com>
>     Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
>     Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
I added Ma Jun to the email.

Regards,
   Felix


>
> struct crat_subtype_cache {
>          ...
>          uint8_t         sibling_map[CRAT_SIBLINGMAP_SIZE];
>
> #define CRAT_SIBLINGMAP_SIZE    32
>
>
> struct kfd_cache_properties {
>          ...
>          uint8_t                 sibling_map[CACHE_SIBLINGMAP_SIZE];
>
> #define CACHE_SIBLINGMAP_SIZE 64
>
> Thanks for your attention!
>