kernel/linux.git/drivers/gpu/drm/amd/ras, branch v7.2-rc1

drm/amd/ras: validate RAS EEPROM tbl_size before record count

2026-06-03T17:52:55+00:00

Corrupt EEPROM data can set tbl_size below the table header size. Guard the RAS_NUM_RECS macros against undersized tbl_size and reset the table during init when tbl_size is below the minimum for the table version instead of trusting the header. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher

drm/amd/ras: Remove redundant error log

2026-06-03T17:50:36+00:00

amdgpu_ras_inject_error() currently prints an extra "ras inject block %u failed" message, remove the redundant log. Signed-off-by: Stanley.Yang Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher

drm/amd/ras: snapshot remote cmd header to fix double-fetch

2026-06-03T17:50:34+00:00

The response header lives in PF-controlled shared memory. Copy it into a local struct once, then read cmd_res and output_size from the snapshot so the PF cannot flip cmd_res or grow output_size between checks. Signed-off-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher

drm/amd/ras: Return RAS TA injection result to userspace

2026-06-03T17:49:48+00:00

Return RAS TA injection result to userspace that avoid app continue to load work once injection failed. Signed-off-by: Stanley.Yang Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher

drm/amd/ras: cap pending_ecc_list size

2026-05-27T14:50:57+00:00

Drop new entries once pending_ecc_count hits RAS_UMC_PENDING_ECC_MAX (8192) so an ECC storm or repeated UMC error injection cannot exhaust kernel memory. Dropped events are counted and reported via a rate-limited warning. Signed-off-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher

drm/amdgpu: Fix TOCTOU on UniRAS command response size

2026-05-27T14:48:30+00:00

The guest maps the PF response in shared VRAM (struct ras_cmd_ctx in the command buffer). After amdgpu_virt_send_remote_ras_cmd() returns, the code validated rcmd->output_size against the caller buffer, then copied rcmd->output_buff_raw using rcmd->output_size again. A malicious PF could change output_size between those reads so the memcpy length exceeds the caller’s output_size and overflows guest stack or heap buffers. Snapshot output_size with READ_ONCE() once, assign cmd->output_size from that value, and use the same snapshot for the bounds check and memcpy. Also read cmd_res once with READ_ONCE() so the error branch and cmd->cmd_res assignment do not observe different values from shared memory. Signed-off-by: Chenglei Xie Reviewed-by: YiPeng Chai Signed-off-by: Alex Deucher

drm/amd/ras: return error when converting records to nps pages fails

2026-05-19T15:54:29+00:00

return error when converting records to nps pages fails Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher

drm/amd/ras: add first record offset check

2026-05-19T15:54:26+00:00

check the upper and lower limits of first record offset Signed-off-by: Gangliang Xie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher

drm/amd/ras: copy ras log data instead of referencing pointers

2026-05-19T15:54:17+00:00

When generating ras cper file, the original data nodes in the ras log ring buffer may be deleted, leading to invalid pointer access. Copy the data from the ras log ring instead of directly referencing the pointers to avoid this issue. Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher

drm/amd/ras: add length check for ras command output buffer

2026-05-19T15:53:14+00:00

Add length check for ras command output buffer. Signed-off-by: YiPeng Chai Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher