[PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning

[Jacob, Anson]

[AMD Public Use]

Thanks Lyude for testing the patch.

Are you referring to this issue [1] ?

Is it reproducible after applying this patch as well ?

[1] https://gitlab.freedesktop.org/drm/amd/-/issues/1473

-- Anson
________________________________
From: Lyude Paul <lyude at redhat.com>
Sent: Friday, March 5, 2021 6:08 PM
To: Jacob, Anson <Anson.Jacob at amd.com>; amd-gfx at lists.freedesktop.org <amd-gfx at lists.freedesktop.org>
Cc: Deucher, Alexander <Alexander.Deucher at amd.com>; Kuehling, Felix <Felix.Kuehling at amd.com>
Subject: Re: [PATCH] drm/amdkfd: Fix UBSAN shift-out-of-bounds warning

Tested-by: Lyude Paul <lyude at redhat.com>

That just leaves the KASAN error from read_indirect_azalia_reg, thanks for the
fix!

On Thu, 2021-03-04 at 15:08 -0500, Anson Jacob wrote:
> If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up
> doing a shift operation where the number of bits shifted equals
> number of bits in the operand. This behaviour is undefined.
>
> Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the
> count is >= number of bits in the operand.
>
> Bug: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgitlab.freedesktop.org%2Fdrm%2Famd%2F-%2Fissues%2F1472&data=04%7C01%7Canson.jacob%40amd.com%7Ce9ea7130bcd945a194aa08d8e02ba9f8%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637505826204096667%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=GEyObPt%2FnEeU9Y7K2I30RS1TBMGbbUneQ6hWkR7pJLM%3D&reserved=0
> Reported-by: Lyude Paul <lyude at redhat.com>
> Signed-off-by: Anson Jacob <Anson.Jacob at amd.com>
> Reviewed-by: Alex Deucher <alexander.deucher at amd.com>
> Reviewed-by: Felix Kuehling <Felix.Kuehling at amd.com>
> ---
>  .../drm/amd/amdkfd/kfd_device_queue_manager.c   | 17 +++++++++++++++--
>  1 file changed, 15 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> index c37e9c4b1fb4..e7a3c496237f 100644
> --- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
> @@ -1128,6 +1128,9 @@ static int set_sched_resources(struct
> device_queue_manager *dqm)
>
>  static int initialize_cpsch(struct device_queue_manager *dqm)
>  {
> +       uint64_t num_sdma_queues;
> +       uint64_t num_xgmi_sdma_queues;
> +
>         pr_debug("num of pipes: %d\n", get_pipes_per_mec(dqm));
>
>         mutex_init(&dqm->lock_hidden);
> @@ -1136,8 +1139,18 @@ static int initialize_cpsch(struct device_queue_manager
> *dqm)
>         dqm->active_cp_queue_count = 0;
>         dqm->gws_queue_count = 0;
>         dqm->active_runlist = false;
> -       dqm->sdma_bitmap = ~0ULL >> (64 - get_num_sdma_queues(dqm));
> -       dqm->xgmi_sdma_bitmap = ~0ULL >> (64 - get_num_xgmi_sdma_queues(dqm));
> +
> +       num_sdma_queues = get_num_sdma_queues(dqm);
> +       if (num_sdma_queues >= BITS_PER_TYPE(dqm->sdma_bitmap))
> +               dqm->sdma_bitmap = ULLONG_MAX;
> +       else
> +               dqm->sdma_bitmap = (BIT_ULL(num_sdma_queues) - 1);
> +
> +       num_xgmi_sdma_queues = get_num_xgmi_sdma_queues(dqm);
> +       if (num_xgmi_sdma_queues >= BITS_PER_TYPE(dqm->xgmi_sdma_bitmap))
> +               dqm->xgmi_sdma_bitmap = ULLONG_MAX;
> +       else
> +               dqm->xgmi_sdma_bitmap = (BIT_ULL(num_xgmi_sdma_queues) - 1);
>
>         INIT_WORK(&dqm->hw_exception_work, kfd_process_hw_exception);
>

--
Sincerely,
   Lyude Paul (she/her)
   Software Engineer at Red Hat

Note: I deal with a lot of emails and have a lot of bugs on my plate. If you've
asked me a question, are waiting for a review/merge on a patch, etc. and I
haven't responded in a while, please feel free to send me another email to check
on my status. I don't bite!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/amd-gfx/attachments/20210306/1e5f8daf/attachment.htm>