On Fri, Jul 30, 2021 at 12:11:15PM -0700, Lucas De Marchi wrote:
> There's a missing sentinel since we are not using ARRAY_SIZE(), but rather
> checking that the .start is 0 to stop the iteration in mcr_range().
>
> BUG: KASAN: global-out-of-bounds in mcr_range.isra.0+0x69/0xa0 [i915]
> Read of size 4 at addr ffffffffa0889928 by task modprobe/3881
>
> Fixes: d8905ba705ab ("drm/i915/xehp: Define multicast register ranges")
> Signed-off-by: Lucas De Marchi <lucas.demarchi@xxxxxxxxx>
Reviewed-by: Matt Roper <matthew.d.roper@xxxxxxxxx>
> ---
> drivers/gpu/drm/i915/gt/intel_workarounds.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_workarounds.c b/drivers/gpu/drm/i915/gt/intel_workarounds.c
> index 9173df59821a..053fa7251cd0 100644
> --- a/drivers/gpu/drm/i915/gt/intel_workarounds.c
> +++ b/drivers/gpu/drm/i915/gt/intel_workarounds.c
> @@ -2000,6 +2000,7 @@ static const struct mcr_range mcr_ranges_xehp[] = {
> { .start = 0xdc00, .end = 0xffff },
> { .start = 0x17000, .end = 0x17fff },
> { .start = 0x24a00, .end = 0x24a7f },
> + {},
> };
>
> static bool mcr_range(struct drm_i915_private *i915, u32 offset)
> --
> 2.31.1
>
--
Matt Roper
Graphics Software Engineer
VTT-OSGC Platform Enablement
Intel Corporation
(916) 356-2795
