Thank you for your contribution! Sashiko AI review found 1 potential issue(s) 
to consider:
- [Medium] Missing bounds validation for the user-provided `threshold` value in 
`set_correctable_error_threshold()`, violating the DRM RAS core API contract.
--

--- Patch [4]: [PATCH v6 4/5] drm/xe/drm_ras: Wire up error threshold callbacks 
---
commit 07d0b2b18f83648184a377e573f78e416567ad07
Author: Raag Jadav <[email protected]>

drm/xe/drm_ras: Wire up error threshold callbacks

This commit wires up the get/set error threshold support in the xe driver to
drm_ras, allowing userspace to make use of this functionality via netlink.

> diff --git a/drivers/gpu/drm/xe/xe_drm_ras.c b/drivers/gpu/drm/xe/xe_drm_ras.c
> index 78184b6ea7d48..7f3695707611c 100644
> --- a/drivers/gpu/drm/xe/xe_drm_ras.c
> +++ b/drivers/gpu/drm/xe/xe_drm_ras.c

[ ... ]

> +static int set_correctable_error_threshold(struct drm_ras_node *ep, u32 
> error_id, u32 threshold)
> +{
> +     struct xe_device *xe = ep->priv;
> +     struct xe_drm_ras *ras = &xe->ras;
> +     struct xe_drm_ras_counter *info = 
> ras->info[DRM_XE_RAS_ERR_SEV_CORRECTABLE];
> +
> +     if (!info || !info[error_id].name)
> +             return -ENOENT;
> +
> +     if (!xe->info.has_sysctrl)
> +             return -EOPNOTSUPP;
> +
> +     return xe_ras_set_threshold(xe, DRM_XE_RAS_ERR_SEV_CORRECTABLE, 
> error_id, threshold);

[Severity: Medium]
Does this code need to validate the threshold bounds before passing it to the
firmware?

The set_error_threshold documentation in include/drm/drm_ras.h explicitly
states: "Driver is responsible for error threshold bounds checking."

Passing an unvalidated user-provided threshold directly to
xe_ras_set_threshold() and the system controller firmware might cause
unexpected behavior or denial-of-service conditions if the firmware does not
robustly handle edge cases like extremely large values or a threshold of 0.

> +}

[ ... ]

-- 
Sashiko AI review ยท 
https://sashiko.dev/#/patchset/[email protected]?part=4

Reply via email to