diff options
| author | Candice Li <candice.li@amd.com> | 2026-05-13 10:46:01 +0800 |
|---|---|---|
| committer | Alex Deucher <alexander.deucher@amd.com> | 2026-05-19 11:51:52 -0400 |
| commit | 3c88fb7aa57d540e1867aad56d441e550692bd1a (patch) | |
| tree | 4ba4616de255e7af5e1b52a63b25f0f8c541e6a3 | |
| parent | f6b6ef70bf606de4b13ff81da62dfea294c7007f (diff) | |
| download | lwn-3c88fb7aa57d540e1867aad56d441e550692bd1a.tar.gz lwn-3c88fb7aa57d540e1867aad56d441e550692bd1a.zip | |
drm/amd/ras: bound CPER record fetch buffer size
Bound CPER record fetch allocation by buffer size.
v2: Drop redundant cap on cper_num and raise
GET_CPER_RECORD max buffer size.
Suggested-by: YiPeng Chai <YiPeng.Chai@amd.com>
Signed-off-by: Candice Li <candice.li@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
| -rw-r--r-- | drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c | 3 | ||||
| -rw-r--r-- | drivers/gpu/drm/amd/ras/rascore/ras_cmd.c | 3 | ||||
| -rw-r--r-- | drivers/gpu/drm/amd/ras/rascore/ras_cmd.h | 3 |
3 files changed, 7 insertions, 2 deletions
diff --git a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c index 4021259115cc..daad99a46263 100644 --- a/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c +++ b/drivers/gpu/drm/amd/ras/ras_mgr/amdgpu_virt_ras_cmd.c @@ -264,7 +264,8 @@ static int amdgpu_virt_ras_get_cper_records(struct ras_core_context *ras_core, if (cmd->input_size != sizeof(struct ras_cmd_cper_record_req)) return RAS_CMD__ERROR_INVALID_INPUT_SIZE; - if (!req->buf_size || !req->buf_ptr || !req->cper_num) + if (!req->buf_size || !req->buf_ptr || !req->cper_num || + req->buf_size > RAS_CMD_MAX_CPER_BUF_SZ) return RAS_CMD__ERROR_INVALID_INPUT_DATA; trace = kzalloc_objs(*trace, MAX_RECORD_PER_BATCH); diff --git a/drivers/gpu/drm/amd/ras/rascore/ras_cmd.c b/drivers/gpu/drm/amd/ras/rascore/ras_cmd.c index 4f89810d85a1..8303aecf91ba 100644 --- a/drivers/gpu/drm/amd/ras/rascore/ras_cmd.c +++ b/drivers/gpu/drm/amd/ras/rascore/ras_cmd.c @@ -214,7 +214,8 @@ static int ras_cmd_get_cper_records(struct ras_core_context *ras_core, if (cmd->input_size != sizeof(struct ras_cmd_cper_record_req)) return RAS_CMD__ERROR_INVALID_INPUT_SIZE; - if (!req->buf_size || !req->buf_ptr || !req->cper_num) + if (!req->buf_size || !req->buf_ptr || !req->cper_num || + req->buf_size > RAS_CMD_MAX_CPER_BUF_SZ) return RAS_CMD__ERROR_INVALID_INPUT_DATA; buffer = kzalloc(req->buf_size, GFP_KERNEL); diff --git a/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h b/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h index 7ea35a028987..a1d4b8b02841 100644 --- a/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h +++ b/drivers/gpu/drm/amd/ras/rascore/ras_cmd.h @@ -405,6 +405,9 @@ struct batch_ras_trace_info { #define RAS_CMD_MAX_BATCH_NUM 300 #define RAS_CMD_MAX_TRACE_NUM 300 + +/* Upper bounds for RAS_CMD__GET_CPER_RECORD to limit kernel allocations and work. */ +#define RAS_CMD_MAX_CPER_BUF_SZ (2 * 1024U * 1024U) /* 2 MiB */ struct ras_cmd_batch_trace_record_rsp { uint32_t version; uint16_t real_batch_num; |