On 9/8/2026 4:23 PM, Umesh Nerlige Ramappa wrote:
I think you need to add "Discovered using AI-assisted static analysis confirmed by Intel Product Security." into the commit message for this patch.intel_guc_lookup_engine() indexes gt->engine_class[][] with a class and instance pair that originates from the GuC, guarded only by GEM_BUG_ON. That compiles out on production builds, so nothing validates either index at runtime. Range check both indices and return NULL when either is out of range. Callers already handle a NULL return, so no caller changes are needed.
Fixes: f7957e603cbc ("drm/i915/guc: Handle engine reset failure notification")
Reported-by: Martin Hodo <[email protected]>
Signed-off-by: Umesh Nerlige Ramappa <[email protected]>
Assisted-by: Claude:claude-opus-5
Reviewed-by: Jesus Narvaez <[email protected]> Jesus Narvaez
--- drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c index 788e59cdfac9..9d3bd16adf40 100644 --- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c @@ -5301,10 +5301,16 @@ struct intel_engine_cs * intel_guc_lookup_engine(struct intel_guc *guc, u8 guc_class, u8 instance) { struct intel_gt *gt = guc_to_gt(guc); - u8 engine_class = guc_class_to_engine_class(guc_class); + u8 engine_class;- /* Class index is checked in class converter */- GEM_BUG_ON(instance > MAX_ENGINE_INSTANCE); + /* + * Both indices come from the GuC, so range check them here rather than + * relying on the debug-only assertions in the class converter. + */ + if (guc_class > GUC_LAST_ENGINE_CLASS || instance > MAX_ENGINE_INSTANCE) + return NULL; + + engine_class = guc_class_to_engine_class(guc_class);return gt->engine_class[engine_class][instance];}
