drm/amd/ras: bound CPER record fetch buffer size

Bound CPER record fetch allocation by buffer size.

v2: Drop redundant cap on cper_num and raise
    GET_CPER_RECORD max buffer size.

Suggested-by: YiPeng Chai <YiPeng.Chai@amd.com>
Signed-off-by: Candice Li <candice.li@amd.com>
Reviewed-by: Tao Zhou <tao.zhou1@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Candice Li
2026-05-13 10:46:01 +08:00
committed by Alex Deucher
parent f6b6ef70bf
commit 3c88fb7aa5
3 changed files with 7 additions and 2 deletions

View File

@@ -264,7 +264,8 @@ static int amdgpu_virt_ras_get_cper_records(struct ras_core_context *ras_core,
if (cmd->input_size != sizeof(struct ras_cmd_cper_record_req))
return RAS_CMD__ERROR_INVALID_INPUT_SIZE;
if (!req->buf_size || !req->buf_ptr || !req->cper_num)
if (!req->buf_size || !req->buf_ptr || !req->cper_num ||
req->buf_size > RAS_CMD_MAX_CPER_BUF_SZ)
return RAS_CMD__ERROR_INVALID_INPUT_DATA;
trace = kzalloc_objs(*trace, MAX_RECORD_PER_BATCH);

View File

@@ -214,7 +214,8 @@ static int ras_cmd_get_cper_records(struct ras_core_context *ras_core,
if (cmd->input_size != sizeof(struct ras_cmd_cper_record_req))
return RAS_CMD__ERROR_INVALID_INPUT_SIZE;
if (!req->buf_size || !req->buf_ptr || !req->cper_num)
if (!req->buf_size || !req->buf_ptr || !req->cper_num ||
req->buf_size > RAS_CMD_MAX_CPER_BUF_SZ)
return RAS_CMD__ERROR_INVALID_INPUT_DATA;
buffer = kzalloc(req->buf_size, GFP_KERNEL);

View File

@@ -405,6 +405,9 @@ struct batch_ras_trace_info {
#define RAS_CMD_MAX_BATCH_NUM 300
#define RAS_CMD_MAX_TRACE_NUM 300
/* Upper bounds for RAS_CMD__GET_CPER_RECORD to limit kernel allocations and work. */
#define RAS_CMD_MAX_CPER_BUF_SZ (2 * 1024U * 1024U) /* 2 MiB */
struct ras_cmd_batch_trace_record_rsp {
uint32_t version;
uint16_t real_batch_num;