From dd086d18e34bd5506b952c6fafdb4893a95e3e27 Mon Sep 17 00:00:00 2001 From: Fiona Ebner Date: Tue, 14 Nov 2023 13:14:43 +0100 Subject: [PATCH] backport UBSAN fixes for amdgpu to silence array-index-out-of-bounds warnings for dynamically-sized arrays. All commits applied cleanly and just replace array[1] with array[]. Signed-off-by: Fiona Ebner --- ...N-array-index-out-of-bounds-for-SMU7.patch | 63 ++++++++ ...N-array-index-out-of-bounds-for-Pola.patch | 76 +++++++++ ...N-array-index-out-of-bounds-for-Powe.patch | 146 ++++++++++++++++++ 3 files changed, 285 insertions(+) create mode 100644 patches/kernel/0014-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch create mode 100644 patches/kernel/0015-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch create mode 100644 patches/kernel/0016-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Powe.patch diff --git a/patches/kernel/0014-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch b/patches/kernel/0014-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch new file mode 100644 index 0000000..e419466 --- /dev/null +++ b/patches/kernel/0014-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-SMU7.patch @@ -0,0 +1,63 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Wed, 4 Oct 2023 15:22:52 -0500 +Subject: [PATCH] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 + +For pptable structs that use flexible array sizes, use flexible arrays. + +Suggested-by: Felix Held +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 +Signed-off-by: Mario Limonciello +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry-picked from commit 760efbca74a405dc439a013a5efaa9fadc95a8c3) +Signed-off-by: Fiona Ebner +--- + drivers/gpu/drm/amd/include/pptable.h | 4 ++-- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/include/pptable.h b/drivers/gpu/drm/amd/include/pptable.h +index 0b6a057e0a4c..5aac8d545bdc 100644 +--- a/drivers/gpu/drm/amd/include/pptable.h ++++ b/drivers/gpu/drm/amd/include/pptable.h +@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER + typedef struct _ATOM_PPLIB_STATE + { + UCHAR ucNonClockStateIndex; +- UCHAR ucClockStateIndices[1]; // variable-sized ++ UCHAR ucClockStateIndices[]; // variable-sized + } ATOM_PPLIB_STATE; + + +@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2 + /** + * Driver will read the first ucNumDPMLevels in this array + */ +- UCHAR clockInfoIndex[1]; ++ UCHAR clockInfoIndex[]; + } ATOM_PPLIB_STATE_V2; + + typedef struct _StateArray{ +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +index b0ac4d121adc..41444e27bfc0 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record { + typedef struct _ATOM_Tonga_MCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_MCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_MCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_MCLK_Dependency_Table; + + typedef struct _ATOM_Tonga_SCLK_Dependency_Record { +@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record { + typedef struct _ATOM_Tonga_SCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_SCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_SCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_SCLK_Dependency_Table; + + typedef struct _ATOM_Polaris_SCLK_Dependency_Record { diff --git a/patches/kernel/0015-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch b/patches/kernel/0015-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch new file mode 100644 index 0000000..dd82cd5 --- /dev/null +++ b/patches/kernel/0015-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Pola.patch @@ -0,0 +1,76 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Wed, 4 Oct 2023 15:46:44 -0500 +Subject: [PATCH] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and + Tonga + +For pptable structs that use flexible array sizes, use flexible arrays. + +Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742 +Signed-off-by: Mario Limonciello +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +(cherry-picked from commit 0f0e59075b5c22f1e871fbd508d6e4f495048356) +Signed-off-by: Fiona Ebner +--- + .../gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +index 41444e27bfc0..e0e40b054c08 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State { + typedef struct _ATOM_Tonga_State_Array { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_State entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_State entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_State_Array; + + typedef struct _ATOM_Tonga_MCLK_Dependency_Record { +@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record { + typedef struct _ATOM_Polaris_SCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Polaris_SCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Polaris_SCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Polaris_SCLK_Dependency_Table; + + typedef struct _ATOM_Tonga_PCIE_Record { +@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record { + typedef struct _ATOM_Tonga_PCIE_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_PCIE_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_PCIE_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_PCIE_Table; + + typedef struct _ATOM_Polaris10_PCIE_Record { +@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record { + typedef struct _ATOM_Polaris10_PCIE_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Polaris10_PCIE_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Polaris10_PCIE_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Polaris10_PCIE_Table; + + +@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record { + typedef struct _ATOM_Tonga_MM_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_MM_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_MM_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_MM_Dependency_Table; + + typedef struct _ATOM_Tonga_Voltage_Lookup_Record { +@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record { + typedef struct _ATOM_Tonga_Voltage_Lookup_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_Voltage_Lookup_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_Voltage_Lookup_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_Voltage_Lookup_Table; + + typedef struct _ATOM_Tonga_Fan_Table { diff --git a/patches/kernel/0016-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Powe.patch b/patches/kernel/0016-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Powe.patch new file mode 100644 index 0000000..6f92403 --- /dev/null +++ b/patches/kernel/0016-drm-amd-Fix-UBSAN-array-index-out-of-bounds-for-Powe.patch @@ -0,0 +1,146 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 27 Oct 2023 16:40:47 -0400 +Subject: [PATCH] drm/amd: Fix UBSAN array-index-out-of-bounds for Powerplay + headers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +For pptable structs that use flexible array sizes, use flexible arrays. + +Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2039926 +Reviewed-by: Mario Limonciello +Acked-by: Christian König +Signed-off-by: Alex Deucher +(cherry-picked from commit 49afe91370b86566857a3c2c39612cf098110885) +Signed-off-by: Fiona Ebner +--- + .../drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++-- + .../amd/pm/powerplay/hwmgr/vega10_pptable.h | 24 +++++++++---------- + 2 files changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +index e0e40b054c08..5ec564dbf339 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +@@ -367,7 +367,7 @@ typedef struct _ATOM_Tonga_VCE_State_Record { + typedef struct _ATOM_Tonga_VCE_State_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; +- ATOM_Tonga_VCE_State_Record entries[1]; ++ ATOM_Tonga_VCE_State_Record entries[]; + } ATOM_Tonga_VCE_State_Table; + + typedef struct _ATOM_Tonga_PowerTune_Table { +@@ -482,7 +482,7 @@ typedef struct _ATOM_Tonga_Hard_Limit_Record { + typedef struct _ATOM_Tonga_Hard_Limit_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; +- ATOM_Tonga_Hard_Limit_Record entries[1]; ++ ATOM_Tonga_Hard_Limit_Record entries[]; + } ATOM_Tonga_Hard_Limit_Table; + + typedef struct _ATOM_Tonga_GPIO_Table { +diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h +index 9c479bd9a786..a372abcd01be 100644 +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_pptable.h +@@ -129,7 +129,7 @@ typedef struct _ATOM_Vega10_State { + typedef struct _ATOM_Vega10_State_Array { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Vega10_State states[1]; /* Dynamically allocate entries. */ ++ ATOM_Vega10_State states[]; /* Dynamically allocate entries. */ + } ATOM_Vega10_State_Array; + + typedef struct _ATOM_Vega10_CLK_Dependency_Record { +@@ -169,37 +169,37 @@ typedef struct _ATOM_Vega10_GFXCLK_Dependency_Table { + typedef struct _ATOM_Vega10_MCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Vega10_MCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Vega10_MCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Vega10_MCLK_Dependency_Table; + + typedef struct _ATOM_Vega10_SOCCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Vega10_SOCCLK_Dependency_Table; + + typedef struct _ATOM_Vega10_DCEFCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Vega10_DCEFCLK_Dependency_Table; + + typedef struct _ATOM_Vega10_PIXCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Vega10_PIXCLK_Dependency_Table; + + typedef struct _ATOM_Vega10_DISPCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries.*/ +- ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Vega10_DISPCLK_Dependency_Table; + + typedef struct _ATOM_Vega10_PHYCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Vega10_CLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Vega10_CLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Vega10_PHYCLK_Dependency_Table; + + typedef struct _ATOM_Vega10_MM_Dependency_Record { +@@ -213,7 +213,7 @@ typedef struct _ATOM_Vega10_MM_Dependency_Record { + typedef struct _ATOM_Vega10_MM_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries */ +- ATOM_Vega10_MM_Dependency_Record entries[1]; /* Dynamically allocate entries */ ++ ATOM_Vega10_MM_Dependency_Record entries[]; /* Dynamically allocate entries */ + } ATOM_Vega10_MM_Dependency_Table; + + typedef struct _ATOM_Vega10_PCIE_Record { +@@ -225,7 +225,7 @@ typedef struct _ATOM_Vega10_PCIE_Record { + typedef struct _ATOM_Vega10_PCIE_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries */ +- ATOM_Vega10_PCIE_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Vega10_PCIE_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Vega10_PCIE_Table; + + typedef struct _ATOM_Vega10_Voltage_Lookup_Record { +@@ -235,7 +235,7 @@ typedef struct _ATOM_Vega10_Voltage_Lookup_Record { + typedef struct _ATOM_Vega10_Voltage_Lookup_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries */ +- ATOM_Vega10_Voltage_Lookup_Record entries[1]; /* Dynamically allocate entries */ ++ ATOM_Vega10_Voltage_Lookup_Record entries[]; /* Dynamically allocate entries */ + } ATOM_Vega10_Voltage_Lookup_Table; + + typedef struct _ATOM_Vega10_Fan_Table { +@@ -329,7 +329,7 @@ typedef struct _ATOM_Vega10_VCE_State_Table + { + UCHAR ucRevId; + UCHAR ucNumEntries; +- ATOM_Vega10_VCE_State_Record entries[1]; ++ ATOM_Vega10_VCE_State_Record entries[]; + } ATOM_Vega10_VCE_State_Table; + + typedef struct _ATOM_Vega10_PowerTune_Table { +@@ -432,7 +432,7 @@ typedef struct _ATOM_Vega10_Hard_Limit_Table + { + UCHAR ucRevId; + UCHAR ucNumEntries; +- ATOM_Vega10_Hard_Limit_Record entries[1]; ++ ATOM_Vega10_Hard_Limit_Record entries[]; + } ATOM_Vega10_Hard_Limit_Table; + + typedef struct _Vega10_PPTable_Generic_SubTable_Header