From mboxrd@z Thu Jan 1 00:00:00 1970 From: Claude Code Review Bot To: dri-devel-reviews@example.com Subject: Claude review: drm/xe/ras: Get error threshold support Date: Sat, 16 May 2026 12:54:50 +1000 Message-ID: In-Reply-To: <20260512191610.1817578-6-raag.jadav@intel.com> References: <20260512191610.1817578-1-raag.jadav@intel.com> <20260512191610.1817578-6-raag.jadav@intel.com> X-Mailer: Claude Code Patch Reviewer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Patch Review Implements `xe_ras_get_threshold()` which sends a mailbox command to the sy= stem controller. **Issue: No bounds checking on `severity` and `component` parameters before= array indexing.** ```c int xe_ras_get_threshold(struct xe_device *xe, u32 severity, u32 component,= u32 *threshold) { ... counter.common.severity =3D drm_to_xe_ras_severities[severity]; counter.common.component =3D drm_to_xe_ras_components[component]; ``` The `severity` and `component` values come from the drm_ras callback, which= passes `error_id` as the component. Although the drm_ras core does range-c= heck `error_id` against `error_counter_range`, there is no explicit bounds = check in `xe_ras_get_threshold()` itself against the array sizes of `drm_to= _xe_ras_severities[]` and `drm_to_xe_ras_components[]`. Since the caller ha= rd-codes `DRM_XE_RAS_ERR_SEV_CORRECTABLE` for severity, that's safe for now= , but the function signature accepts arbitrary `u32` values, making it frag= ile for future use. At minimum, defensive checks or `BUILD_BUG_ON` assertio= ns tying the array size to expected usage would be prudent. **Minor: Unused `counter` assignment from response.** ```c counter =3D response.counter; *threshold =3D response.threshold; ``` The `counter` variable is reassigned from the response but only used in the= debug print. This is fine for debugging but the local variable `counter` s= hadows the fact that it was previously the *request* counter =E2=80=94 coul= d be confusing. Consider using a separate variable name or just accessing `= response.counter.common.*` directly in the debug print. --- --- Generated by Claude Code Patch Reviewer