<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>On Tue, 2023-10-31 at 15:18 +1000, Dave Airlie wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div>+ strings = (char *)&rpc->entries[NV_GSP_REG_NUM_ENTRIES];<br>
</div>
</blockquote>
<div><br>
</div>
<div>I get a UBSAN index-out-of-bounds error on boot at this line. </div>
<div><br>
</div>
<div>[ 17.765746] nouveau 0000:65:00.0: gsp: cmdq: wptr 1</div>
<div>[ 17.765748] ================================================================================</div>
<div>[ 17.774170] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1065:33</div>
<div>[ 17.783449] index 2 is out of range for type 'PACKED_REGISTRY_ENTRY [*]'</div>
<div>[ 17.790132] CPU: 0 PID: 234 Comm: kworker/0:4 Not tainted 6.6.0-rc5+ #1</div>
<div>[ 17.790135] Hardware name: ASUS X299-A/PRIME X299-A, BIOS 2002 09/25/2019</div>
<div>[ 17.790136] Workqueue: events work_for_cpu_fn</div>
<div>[ 17.790143] Call Trace:</div>
<div>[ 17.790145] <TASK></div>
<div>[ 17.790148] dump_stack_lvl+0x48/0x70</div>
<div>[ 17.790155] dump_stack+0x10/0x20</div>
<div>[ 17.790156] __ubsan_handle_out_of_bounds+0xc6/0x110</div>
<div>[ 17.790160] r535_gsp_oneinit+0xf81/0x1530 [nouveau]</div>
<div>[ 17.790292] ? __dev_printk+0x39/0xa0</div>
<div>[ 17.790295] ? _dev_info+0x75/0xa0</div>
<div>[ 17.790298] tu102_gsp_oneinit+0x9b/0xd0 [nouveau]</div>
<div><br>
</div>
<div>I'm not sure what the fix is. Do we need __attribute__((no_sanitize("array-bounds"))) on PACKED_REGISTRY_TABLE?</div>
<div><br>
</div>
<div><span></span></div>
</body>
</html>