intel_guc_lookup_engine() indexes gt->engine_class[][] with a class and
instance pair that originates from the GuC, guarded only by GEM_BUG_ON.
That compiles out on production builds, so nothing validates either index
at runtime.
Range check both indices and return NULL when either is out of range.
Callers already handle a NULL return, so no caller changes are
needed.
Fixes: f7957e603cbc ("drm/i915/guc: Handle engine reset failure notification")
Reported-by: Martin Hodo <[email protected]>
Signed-off-by: Umesh Nerlige Ramappa <[email protected]>
Assisted-by: Claude:claude-opus-5
---
drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
index 788e59cdfac9..9d3bd16adf40 100644
--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
+++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c
@@ -5301,10 +5301,16 @@ struct intel_engine_cs *
intel_guc_lookup_engine(struct intel_guc *guc, u8 guc_class, u8 instance)
{
struct intel_gt *gt = guc_to_gt(guc);
- u8 engine_class = guc_class_to_engine_class(guc_class);
+ u8 engine_class;
- /* Class index is checked in class converter */
- GEM_BUG_ON(instance > MAX_ENGINE_INSTANCE);
+ /*
+ * Both indices come from the GuC, so range check them here rather than
+ * relying on the debug-only assertions in the class converter.
+ */
+ if (guc_class > GUC_LAST_ENGINE_CLASS || instance > MAX_ENGINE_INSTANCE)
+ return NULL;
+
+ engine_class = guc_class_to_engine_class(guc_class);
return gt->engine_class[engine_class][instance];
}
--
2.53.0
