Nouveau - Nov 2023 - [PATCH 3/3] nouveau/gsp: add some basic registry entries.

On Tue, 2023-10-31 at 15:18 +1000, Dave Airlie wrote:
+       strings = (char *)&rpc->entries[NV_GSP_REG_NUM_ENTRIES];

I get a UBSAN index-out-of-bounds error on boot at this line.

[ 17.765746] nouveau 0000:65:00.0: gsp: cmdq: wptr 1
[ 17.765748]
===============================================================================[
17.774170] UBSAN: array-index-out-of-bounds in
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1065:33
[ 17.783449] index 2 is out of range for type 'PACKED_REGISTRY_ENTRY
[*]'
[ 17.790132] CPU: 0 PID: 234 Comm: kworker/0:4 Not tainted 6.6.0-rc5+ #1
[ 17.790135] Hardware name: ASUS X299-A/PRIME X299-A, BIOS 2002 09/25/2019
[ 17.790136] Workqueue: events work_for_cpu_fn
[ 17.790143] Call Trace:
[ 17.790145] <TASK>
[ 17.790148] dump_stack_lvl+0x48/0x70
[ 17.790155] dump_stack+0x10/0x20
[ 17.790156] __ubsan_handle_out_of_bounds+0xc6/0x110
[ 17.790160] r535_gsp_oneinit+0xf81/0x1530 [nouveau]
[ 17.790292] ? __dev_printk+0x39/0xa0
[ 17.790295] ? _dev_info+0x75/0xa0
[ 17.790298] tu102_gsp_oneinit+0x9b/0xd0 [nouveau]

I'm not sure what the fix is.  Do we need
__attribute__((no_sanitize("array-bounds"))) on PACKED_REGISTRY_TABLE?

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20231107/8a0409bb/attachment.htm>

On Wed, 8 Nov 2023 at 04:51, Timur Tabi <ttabi at nvidia.com>
wrote:
>
> On Tue, 2023-10-31 at 15:18 +1000, Dave Airlie wrote:
>
> +       strings = (char *)&rpc->entries[NV_GSP_REG_NUM_ENTRIES];
>
>
> I get a UBSAN index-out-of-bounds error on boot at this line.
>
> [ 17.765746] nouveau 0000:65:00.0: gsp: cmdq: wptr 1
> [ 17.765748]
===============================================================================>
[ 17.774170] UBSAN: array-index-out-of-bounds in
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1065:33
> [ 17.783449] index 2 is out of range for type 'PACKED_REGISTRY_ENTRY
[*]'
> [ 17.790132] CPU: 0 PID: 234 Comm: kworker/0:4 Not tainted 6.6.0-rc5+ #1
> [ 17.790135] Hardware name: ASUS X299-A/PRIME X299-A, BIOS 2002 09/25/2019
> [ 17.790136] Workqueue: events work_for_cpu_fn
> [ 17.790143] Call Trace:
> [ 17.790145] <TASK>
> [ 17.790148] dump_stack_lvl+0x48/0x70
> [ 17.790155] dump_stack+0x10/0x20
> [ 17.790156] __ubsan_handle_out_of_bounds+0xc6/0x110
> [ 17.790160] r535_gsp_oneinit+0xf81/0x1530 [nouveau]
> [ 17.790292] ? __dev_printk+0x39/0xa0
> [ 17.790295] ? _dev_info+0x75/0xa0
> [ 17.790298] tu102_gsp_oneinit+0x9b/0xd0 [nouveau]
>
> I'm not sure what the fix is.  Do we need
__attribute__((no_sanitize("array-bounds"))) on PACKED_REGISTRY_TABLE?
yes that is probably the right answer for this, if we want to reuse
the structs that we get from the nvidia driver.

Dave.