Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [Medium] Uninitialized stack memory dereference in logical_sort(). -- commit 6153c2c3d514c7a85b553bf0d2bcce6d2b569814 Author: Linmao Li <[email protected]> drm/i915/guc: Return NULL for missing multi-lrc parent This commit updates multi_lrc_create_parent() to return NULL instead of ERR_PTR(0) when there are not enough engines, making the non-error path explicit. > diff --git a/drivers/gpu/drm/i915/gt/uc/selftest_guc_multi_lrc.c > b/drivers/gpu/drm/i915/gt/uc/selftest_guc_multi_lrc.c > index 28e8a092f4e7d..18077801b2e60 100644 > --- a/drivers/gpu/drm/i915/gt/uc/selftest_guc_multi_lrc.c > +++ b/drivers/gpu/drm/i915/gt/uc/selftest_guc_multi_lrc.c > @@ -44,7 +44,7 @@ multi_lrc_create_parent(struct intel_gt *gt, u8 class, > } > > if (i <= 1) > - return ERR_PTR(0); > + return NULL; > > logical_sort(siblings, i); [Severity: Medium] This is a pre-existing issue, but does logical_sort() dereference uninitialized stack memory here? In multi_lrc_create_parent(), the local array siblings is allocated with size MAX_ENGINE_INSTANCE + 1 but only populated up to index 'i' before being passed to logical_sort(). Inside logical_sort(), the inner loop iterates up to MAX_ENGINE_INSTANCE + 1 instead of num_engines, accessing elements that were never initialized: static void logical_sort(struct intel_engine_cs **engines, int num_engines) { ... for (i = 0; i < num_engines; ++i) for (j = 0; j < MAX_ENGINE_INSTANCE + 1; ++j) { if (engines[j]->logical_mask & BIT(i)) { ... } } ... } Could this lead to a wild pointer dereference during selftest execution whenever j >= num_engines? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
