UBSAN: array-index-out-of-bounds in dcn31_resources on AMD yellow carp platform
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
HWE Next |
Fix Released
|
Undecided
|
Unassigned | ||
linux (Ubuntu) |
Fix Released
|
High
|
You-Sheng Yang | ||
Jammy |
Fix Released
|
High
|
You-Sheng Yang |
Bug Description
[SRU Justification]
[Impact]
On HP Lockheed16, following UBSAN warning dumped at boot and the first
USB4 port is disabled:
UBSAN: array-index-
index 6 is out of range for type 'dcn10_
This is a follow-up for bug 1953008 on Jammy, which only happens when
patches for USB4 alt mode were applied and tested on a HP platform.
[Fix]
Commit d374d3b49321 ("drm/amd/display: Fix out of bounds access on DNC31
stream encoder regs") from Linus' tree.
[Test Case]
Apply and check no more such warning, and USB alt mode should work.
[Where problems could occur]
No. This specifies the expected array size to avoid UBSAN warning.
[Other Info]
While UBSAN is only turned on by default on 5.15 kernels or newer, and
we didn't find this issue on oem-5.14, so only Jammy is nominated here.
========== original bug report ==========
UBSAN: array-index-
This is a follow-up for bug 1953008, which only happens when patches for USB4 alt mode were applied.
This is found on HP Lockheed16 and will disable one of the tbt port.
Source tree available in https:/
1263 static struct stream_encoder *dcn31_
1264 enum engine_id eng_id,
1265 struct dc_context *ctx)
1266 {
...
1293 dcn30_dio_
1294 eng_id, vpg, afmt,
1295 &stream_
1296 &se_shift, &se_mask);
[ 5.557065] [drm] amdgpu kernel modesetting enabled.
[ 5.562748] amdgpu: Virtual CRAT table created for CPU
[ 5.562769] amdgpu: Topology: Add CPU node
[ 5.563048] checking generic (320000000 8ca000) vs hw (320000000 10000000)
[ 5.563053] fb0: switching to amdgpu from EFI VGA
[ 5.563274] Console: switching to colour dummy device 80x25
[ 5.563386] amdgpu 0000:64:00.0: vgaarb: deactivate vga console
[ 5.563768] [drm] initializing kernel modesetting (YELLOW_CARP 0x1002:0x1681 0x103C:0x8990 0xD5).
[ 5.563791] amdgpu 0000:64:00.0: amdgpu: Trusted Memory Zone (TMZ) feature disabled as experimental (default)
[ 5.563968] [drm] register mmio base: 0xA4800000
[ 5.563969] [drm] register mmio size: 524288
[ 5.563976] [drm] PCIE atomic ops is not supported
[ 5.565481] [drm] add ip block number 0 <nv_common>
[ 5.565483] [drm] add ip block number 1 <gmc_v10_0>
[ 5.565484] [drm] add ip block number 2 <navi10_ih>
[ 5.565485] [drm] add ip block number 3 <psp>
[ 5.565486] [drm] add ip block number 4 <smu>
[ 5.565487] [drm] add ip block number 5 <gfx_v10_0>
[ 5.565488] [drm] add ip block number 6 <sdma_v5_2>
[ 5.565490] [drm] add ip block number 7 <dm>
[ 5.565491] [drm] add ip block number 8 <vcn_v3_0>
[ 5.565492] [drm] add ip block number 9 <jpeg_v3_0>
[ 5.565512] amdgpu 0000:64:00.0: amdgpu: Fetched VBIOS from VFCT
[ 5.565515] amdgpu: ATOM BIOS: 113-REMBRANDT-032
[ 5.565529] [drm] VCN(0) decode is enabled in VM mode
[ 5.565530] [drm] VCN(0) encode is enabled in VM mode
[ 5.565532] [drm] JPEG decode is enabled in VM mode
[ 5.565570] [drm] vm size is 262144 GB, 4 levels, block size is 9-bit, fragment size is 9-bit
[ 5.565576] amdgpu 0000:64:00.0: amdgpu: VRAM: 512M 0x000000F400000000 - 0x000000F41FFFFFFF (512M used)
[ 5.565579] amdgpu 0000:64:00.0: amdgpu: GART: 512M 0x0000000000000000 - 0x000000001FFFFFFF
[ 5.565580] amdgpu 0000:64:00.0: amdgpu: AGP: 267419648M 0x000000F800000000 - 0x0000FFFFFFFFFFFF
[ 5.565589] [drm] Detected VRAM RAM=512M, BAR=512M
[ 5.565590] [drm] RAM width 64bits DDR5
[ 5.565640] [drm] amdgpu: 512M of VRAM memory ready
[ 5.565642] [drm] amdgpu: 3072M of GTT memory ready.
[ 5.565658] [drm] GART: num cpu pages 131072, num gpu pages 131072
[ 5.566076] [drm] PCIE GART of 512M enabled (table at 0x000000F4008CA
[ 5.567973] amdgpu 0000:64:00.0: amdgpu: PSP runtime database doesn't exist
[ 5.573492] [drm] use_doorbell being set to: [true]
[ 5.574279] [drm] Loading DMUB firmware via PSP: version=0x0400000D
[ 5.574727] [drm] Found VCN firmware Version ENC: 1.14 DEC: 2 VEP: 0 Revision: 3
[ 5.574733] amdgpu 0000:64:00.0: amdgpu: Will use PSP to load VCN firmware
[ 5.599344] [drm] reserve 0xa00000 from 0xf41f400000 for PSP TMR
[ 5.625250] usb 3-2.4: reset high-speed USB device number 4 using xhci_hcd
[ 5.644351] intel_rapl_common: Found RAPL domain package
[ 5.644356] intel_rapl_common: Found RAPL domain core
[ 5.665305] amdgpu 0000:64:00.0: amdgpu: RAS: optional ras ta ucode is not available
[ 5.671557] amdgpu 0000:64:00.0: amdgpu: RAP: optional rap ta ucode is not available
[ 5.671562] amdgpu 0000:64:00.0: amdgpu: SECUREDISPLAY: securedisplay ta ucode is not available
[ 5.671649] amdgpu 0000:64:00.0: amdgpu: smu fw reported version = 0x04450800 (1093.8.0)
[ 5.674717] amdgpu 0000:64:00.0: amdgpu: SMU is initialized successfully!
[ 5.675088] [drm] kiq ring mec 2 pipe 1 q 0
[ 5.675818] =======
[ 5.675825] UBSAN: array-index-
[ 5.675829] index 6 is out of range for type 'dcn10_
[ 5.675831] CPU: 5 PID: 431 Comm: systemd-udevd Not tainted 5.15.0-2016-generic #16~20.
[ 5.675834] Hardware name: HP HP EliteBook 865 G9 Notebook PC/8990, BIOS U82 Ver. 80.13.00 10/14/2021
[ 5.675835] Call Trace:
[ 5.675837] <TASK>
[ 5.675839] dump_stack_
[ 5.675848] dump_stack+
[ 5.675849] ubsan_epilogue+
[ 5.675851] __ubsan_
[ 5.675853] dcn31_stream_
[ 5.676031] resource_
[ 5.676164] dcn31_resource_
[ 5.676404] dcn31_create_
[ 5.676531] dc_create_
[ 5.676842] dc_construct+
[ 5.677020] ? kmalloc_
[ 5.677025] dc_create+
[ 5.677194] amdgpu_
[ 5.677341] ? complete+0x3f/0x50
[ 5.677345] ? drm_sched_
[ 5.677349] dm_hw_init+
[ 5.677474] amdgpu_
[ 5.677612] amdgpu_
[ 5.677740] ? pci_read_
[ 5.677745] amdgpu_
[ 5.677836] amdgpu_
[ 5.677924] local_pci_
[ 5.677927] pci_device_
[ 5.677928] really_
[ 5.677932] really_
[ 5.677933] __driver_
[ 5.677934] driver_
[ 5.677935] __driver_
[ 5.677936] ? __device_
[ 5.677937] bus_for_
[ 5.677940] driver_
[ 5.677941] bus_add_
[ 5.677942] driver_
[ 5.677943] __pci_register_
[ 5.677944] amdgpu_
[ 5.678034] ? 0xffffffffc1b97000
[ 5.678035] do_one_
[ 5.678039] ? __cond_
[ 5.678042] ? kmem_cache_
[ 5.678046] do_init_
[ 5.678049] load_module+
[ 5.678051] __do_sys_
[ 5.678053] ? __do_sys_
[ 5.678055] __x64_sys_
[ 5.678056] do_syscall_
[ 5.678058] ? __x64_sys_
[ 5.678061] ? do_syscall_
[ 5.678062] ? syscall_
[ 5.678063] ? __x64_sys_
[ 5.678066] ? do_syscall_
[ 5.678067] ? do_syscall_
[ 5.678068] ? syscall_
[ 5.678069] ? __x64_sys_
[ 5.678071] ? do_syscall_
[ 5.678072] ? sysvec_
[ 5.678073] ? asm_sysvec_
[ 5.678075] entry_SYSCALL_
[ 5.678077] RIP: 0033:0x7f6489ced89d
[ 5.678081] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c3 f5 0c 00 f7 d8 64 89 01 48
[ 5.678083] RSP: 002b:00007ffdae
[ 5.678086] RAX: ffffffffffffffda RBX: 000055c103bc1030 RCX: 00007f6489ced89d
[ 5.678087] RDX: 0000000000000000 RSI: 00007f6489bcaded RDI: 000000000000001a
[ 5.678087] RBP: 0000000000020000 R08: 0000000000000000 R09: 0000000000000000
[ 5.678088] R10: 000000000000001a R11: 0000000000000246 R12: 00007f6489bcaded
[ 5.678089] R13: 0000000000000000 R14: 000055c103bedae0 R15: 000055c103bc1030
[ 5.678090] </TASK>
[ 5.678091] =======
tags: | added: amd oem-priority originate-from-1957782 |
Changed in linux (Ubuntu): | |
status: | Incomplete → In Progress |
importance: | Undecided → High |
assignee: | nobody → You-Sheng Yang (vicamo) |
Changed in linux (Ubuntu Jammy): | |
status: | In Progress → Fix Committed |
Changed in hwe-next: | |
status: | New → Fix Released |
This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:
apport-collect 1958229
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.