Date:   Tue, 21 Feb 2023 10:23:21 -0800
From:   Matt Roper <matthew.d.roper@intel.com>
To:     Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
CC:     Andrea Righi <andrea.righi@canonical.com>,
        Jani Nikula <jani.nikula@linux.intel.com>,
        Joonas Lahtinen <joonas.lahtinen@linux.intel.com>,
        Rodrigo Vivi <rodrigo.vivi@intel.com>,
        David Airlie <airlied@gmail.com>,
        Daniel Vetter <daniel@ffwll.ch>,
        Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>,
        "Emil Renner Berthing" <emil.renner.berthing@canonical.com>,
        <intel-gfx@lists.freedesktop.org>,
        <dri-devel@lists.freedesktop.org>, <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] drm/i915/sseu: fix max_subslices
 array-index-out-of-bounds access
Message-ID: <Y/UMGWDtC593Ob9f@mdroper-desk1.amr.corp.intel.com>
References: <20230220171858.131416-1-andrea.righi@canonical.com>
 <c5edd07d-1535-9b25-9a48-3d71e5e22b07@linux.intel.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <c5edd07d-1535-9b25-9a48-3d71e5e22b07@linux.intel.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?1Rneple0sAHg0E/c2FnNgY6Bb7htMxYiBwvUVWQIk/oDgxQb4G6wToUpvRmY?=
 =?us-ascii?Q?MdyvLq4XPUrAmkj6SKBO7t0aQCvEDDFWPmYPF55H5uDBGnvG84vbPFqPupur?=
 =?us-ascii?Q?LBn8C3VfTp2JZpq7skhSqtoRNTO8qJDjQr+eR56x4Yj03/xtxTuCz46e1miz?=
 =?us-ascii?Q?8EFOmi1VA4rRWQ1eGzlLhhUlsSeJiZ4WVt63PRv7Vhog2U0F0PXT+q3x/E5v?=
 =?us-ascii?Q?NMxQSUW4EBvol2QugKk7JlR0bTLXP9b/MEC4j8/7HYs31bAXc/qOp3wDdCU+?=
 =?us-ascii?Q?yihZcNxX+/fYrFua/ALjP6wHDlzhfvhaPucK1V3TIqVOK96goPXIXh2ItcxS?=
 =?us-ascii?Q?t8NrUchG+GCen/25CvYd9KRUOSur51Tu3y9ISpEGODrpvua2LpK3N0U7ikdS?=
 =?us-ascii?Q?+8+MNFq1idCO3WcKwPIlZ3g3Mv6lsKDYUJKeSVwser1uNTiOYeUS5wbfUJuF?=
 =?us-ascii?Q?IyomlvcuoPKov+DS2VmVB5cTYwWHxhkTiD277ES0PQygC5aQ5mKgHY7oNXF7?=
 =?us-ascii?Q?XXa7EAX8ujIQqEzMlGShqTbwyvLpe4V47eGk/sH4G6hX3GGuU3Kzimt1Q9Fa?=
 =?us-ascii?Q?r9RGh71QYmTBfp2/p9Jvxsrgf1siL1jYhuISDoalEP1VLsMIgibCfrImLM12?=
 =?us-ascii?Q?usEGYKqR5GWEsi5pem89xoNNzyFxmXWeafTLXNopo5+fDgrjot2iMmeAa8w+?=
 =?us-ascii?Q?6Z5mU6OPKLoU8hGftcVzaE9bZ018STH9WE44KJX7IoylU4MeGG8ntnS5fmfs?=
 =?us-ascii?Q?3PTPvIpmWXmJJiBd61DQ18mwIrdQcJIDVBs1+Dhv9tzrbiO/gY5XBkTiKgvw?=
 =?us-ascii?Q?bi3y4Gu0Dz0LS+SQ/bH41u/M0Oc6OQPjAi12t/YJy1mfQ0ARf3lyaFbRokBF?=
 =?us-ascii?Q?xmxAUtrkX8KOHY8vP49xUG9N0XsstfpnNZt4/PjG4NBXKK9vhjS1rpbmiOFO?=
 =?us-ascii?Q?lO5BEUw4w1aUjcJ+NcujXbO9v+YssJ9whaEjujqKM86SRgOWJv6+7rc5aXCb?=
 =?us-ascii?Q?JDQlg80MLTU9yGyIgK9GyCE28vZTjpnxmqcKooUtnXCzvEyLDQwZe7H9IAF5?=
 =?us-ascii?Q?HlSr0SQtRNeyTZwLGSuBBbGt3UtLfp18v0jYW3uw+CY8dos26jlLCUoUKG6h?=
 =?us-ascii?Q?5G4ooTbk5Goe0PJEFMOOLMNBT20erECMiXDszLXpatLKLGU14OTXSp/cmjEh?=
 =?us-ascii?Q?fLdL+fZrX3Ap5lo63bixqDYlGG6W9/JpdYhKx90sHbUZ6Y17yVzarT5jae5v?=
 =?us-ascii?Q?HDqfVgMV4CZ3uaC/yANaxPyeemeqxVwcpnR88zwJPy/OyO4DZi9Hg7vzP6ct?=
 =?us-ascii?Q?0/H6t+bpgNtB4oCGzCrnelhmrU0L9CmKVkIanMuIXVzMy9opQ/vFhHM1dxFp?=
 =?us-ascii?Q?yO2o0Z2W9mRE+bARanlM56iT3hFkMUeVhZTE2vAh1V7t3SXz0i0PWaAmHQlM?=
 =?us-ascii?Q?JZwl3cRGvvRbuOGqFrWjOovcltrSmqfLR80SI4r8nZmdlhojk9thPA3uLPvv?=
 =?us-ascii?Q?TbXOgeBgkHGqR7nCXhWc84iTTYRhyvQkgLnBH04LNAve3voBPNXfTGK1mjFJ?=
 =?us-ascii?Q?NHaAymP7cL4A6o0yLZKGPL19Jsu5wWFPs0YOmauu4yTfKobVZFlfS16J8L8j?=
 =?us-ascii?Q?2A=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 03b587a7-3637-4283-ae4b-08db1438b823
X-MS-Exchange-CrossTenant-AuthSource: DS7PR11MB7859.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Feb 2023 18:23:24.4503
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: x3jgZknBpzJ0drOzf12dJ8uKpt6mYkFC/1bhjFXLsL8RCLSp//zQtXZwfFSPuus5kPVZhtw7/qqGDFfwOp/Ewe9BzLy5Vx5DcH2KYTL+ZJk=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR11MB5477
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Feb 21, 2023 at 09:01:24AM +0000, Tvrtko Ursulin wrote:
> 
> 
> On 20/02/2023 17:18, Andrea Righi wrote:
> > It seems that commit bc3c5e0809ae ("drm/i915/sseu: Don't try to store EU
> > mask internally in UAPI format") exposed a potential out-of-bounds
> > access, reported by UBSAN as following on a laptop with a gen 11 i915
> > card:
> > 
> >    UBSAN: array-index-out-of-bounds in drivers/gpu/drm/i915/gt/intel_sseu.c:65:27
> >    index 6 is out of range for type 'u16 [6]'
> >    CPU: 2 PID: 165 Comm: systemd-udevd Not tainted 6.2.0-9-generic #9-Ubuntu
> >    Hardware name: Dell Inc. XPS 13 9300/077Y9N, BIOS 1.11.0 03/22/2022
> >    Call Trace:
> >     <TASK>
> >     show_stack+0x4e/0x61
> >     dump_stack_lvl+0x4a/0x6f
> >     dump_stack+0x10/0x18
> >     ubsan_epilogue+0x9/0x3a
> >     __ubsan_handle_out_of_bounds.cold+0x42/0x47
> >     gen11_compute_sseu_info+0x121/0x130 [i915]
> >     intel_sseu_info_init+0x15d/0x2b0 [i915]
> >     intel_gt_init_mmio+0x23/0x40 [i915]
> >     i915_driver_mmio_probe+0x129/0x400 [i915]
> >     ? intel_gt_probe_all+0x91/0x2e0 [i915]
> >     i915_driver_probe+0xe1/0x3f0 [i915]
> >     ? drm_privacy_screen_get+0x16d/0x190 [drm]
> >     ? acpi_dev_found+0x64/0x80
> >     i915_pci_probe+0xac/0x1b0 [i915]
> >     ...
> > 
> > According to the definition of sseu_dev_info, eu_mask->hsw is limited to
> > a maximum of GEN_MAX_SS_PER_HSW_SLICE (6) sub-slices, but
> > gen11_sseu_info_init() can potentially set 8 sub-slices, in the
> > !IS_JSL_EHL(gt->i915) case.
> > 
> > Fix this by reserving up to 8 slots for max_subslices in the eu_mask
> > struct.
> > 
> > Reported-by: Emil Renner Berthing <emil.renner.berthing@canonical.com>
> > Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
> 
> Looks like bug was probably introduced in:
> 
> Fixes: bc3c5e0809ae ("drm/i915/sseu: Don't try to store EU mask internally in UAPI format")
> Cc: Matt Roper <matthew.d.roper@intel.com>
> Cc: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
> Cc: <stable@vger.kernel.org> # v6.0+
> 
> Adding Matt to cross-check.

Yep, looks like there's one specific SKU of ICL that has 8 subslices
that we overlooked previously.

Reviewed-by: Matt Roper <matthew.d.roper@intel.com>

> 
> Regards,
> 
> Tvrtko
> 
> > ---
> >   drivers/gpu/drm/i915/gt/intel_sseu.h | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/gpu/drm/i915/gt/intel_sseu.h b/drivers/gpu/drm/i915/gt/intel_sseu.h
> > index aa87d3832d60..d7e8c374f153 100644
> > --- a/drivers/gpu/drm/i915/gt/intel_sseu.h
> > +++ b/drivers/gpu/drm/i915/gt/intel_sseu.h
> > @@ -27,7 +27,7 @@ struct drm_printer;
> >    * is only relevant to pre-Xe_HP platforms (Xe_HP and beyond use the
> >    * I915_MAX_SS_FUSE_BITS value below).
> >    */
> > -#define GEN_MAX_SS_PER_HSW_SLICE	6
> > +#define GEN_MAX_SS_PER_HSW_SLICE	8
> >   /*
> >    * Maximum number of 32-bit registers used by hardware to express the

-- 
Matt Roper
Graphics Software Engineer
Linux GPU Platform Enablement
Intel Corporation