[bug report] drm/amd/display: Add HDCP module

[Lakha, Bhawanpreet]

[AMD Official Use Only - Internal Distribution Only]

Hi,

I will look into it, thanks.

Bhawan
________________________________
From: Dan Carpenter <dan.carpenter at oracle.com>
Sent: April 16, 2020 9:24 AM
To: Lakha, Bhawanpreet <Bhawanpreet.Lakha at amd.com>
Cc: amd-gfx at lists.freedesktop.org <amd-gfx at lists.freedesktop.org>
Subject: [bug report] drm/amd/display: Add HDCP module

Hello Bhawanpreet Lakha,

The patch 4c283fdac08a: "drm/amd/display: Add HDCP module" from Aug
6, 2019, leads to the following static checker warning:

        drivers/gpu/drm/amd/amdgpu/../display/dc/hdcp/hdcp_msg.c:132 hdmi_14_process_transaction()
        error: buffer overflow 'hdcp_i2c_offsets' 32 <= 32

drivers/gpu/drm/amd/amdgpu/../display/dc/hdcp/hdcp_msg.c
    77
    78  static const uint8_t hdcp_i2c_offsets[] = {
    79          [HDCP_MESSAGE_ID_READ_BKSV] = 0x0,
    80          [HDCP_MESSAGE_ID_READ_RI_R0] = 0x8,
    81          [HDCP_MESSAGE_ID_READ_PJ] = 0xA,
    82          [HDCP_MESSAGE_ID_WRITE_AKSV] = 0x10,
    83          [HDCP_MESSAGE_ID_WRITE_AINFO] = 0x15,
    84          [HDCP_MESSAGE_ID_WRITE_AN] = 0x18,
    85          [HDCP_MESSAGE_ID_READ_VH_X] = 0x20,
    86          [HDCP_MESSAGE_ID_READ_VH_0] = 0x20,
    87          [HDCP_MESSAGE_ID_READ_VH_1] = 0x24,
    88          [HDCP_MESSAGE_ID_READ_VH_2] = 0x28,
    89          [HDCP_MESSAGE_ID_READ_VH_3] = 0x2C,
    90          [HDCP_MESSAGE_ID_READ_VH_4] = 0x30,
    91          [HDCP_MESSAGE_ID_READ_BCAPS] = 0x40,
    92          [HDCP_MESSAGE_ID_READ_BSTATUS] = 0x41,
    93          [HDCP_MESSAGE_ID_READ_KSV_FIFO] = 0x43,
    94          [HDCP_MESSAGE_ID_READ_BINFO] = 0xFF,
    95          [HDCP_MESSAGE_ID_HDCP2VERSION] = 0x50,
    96          [HDCP_MESSAGE_ID_WRITE_AKE_INIT] = 0x60,
    97          [HDCP_MESSAGE_ID_READ_AKE_SEND_CERT] = 0x80,
    98          [HDCP_MESSAGE_ID_WRITE_AKE_NO_STORED_KM] = 0x60,
    99          [HDCP_MESSAGE_ID_WRITE_AKE_STORED_KM] = 0x60,
   100          [HDCP_MESSAGE_ID_READ_AKE_SEND_H_PRIME] = 0x80,
   101          [HDCP_MESSAGE_ID_READ_AKE_SEND_PAIRING_INFO] = 0x80,
   102          [HDCP_MESSAGE_ID_WRITE_LC_INIT] = 0x60,
   103          [HDCP_MESSAGE_ID_READ_LC_SEND_L_PRIME] = 0x80,
   104          [HDCP_MESSAGE_ID_WRITE_SKE_SEND_EKS] = 0x60,
   105          [HDCP_MESSAGE_ID_READ_REPEATER_AUTH_SEND_RECEIVERID_LIST] = 0x80,
   106          [HDCP_MESSAGE_ID_WRITE_REPEATER_AUTH_SEND_ACK] = 0x60,
   107          [HDCP_MESSAGE_ID_WRITE_REPEATER_AUTH_STREAM_MANAGE] = 0x60,
   108          [HDCP_MESSAGE_ID_READ_REPEATER_AUTH_STREAM_READY] = 0x80,
   109          [HDCP_MESSAGE_ID_READ_RXSTATUS] = 0x70

HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE is missing.  This array should
have HDCP_MESSAGE_ID_MAX elements.

   110  };
   111
   112  struct protection_properties {
   113          bool supported;
   114          bool (*process_transaction)(
   115                  struct dc_link *link,
   116                  struct hdcp_protection_message *message_info);
   117  };
   118
   119  static const struct protection_properties non_supported_protection = {
   120          .supported = false
   121  };
   122
   123  static bool hdmi_14_process_transaction(
   124          struct dc_link *link,
   125          struct hdcp_protection_message *message_info)
   126  {
   127          uint8_t *buff = NULL;
   128          bool result;
   129          const uint8_t hdcp_i2c_addr_link_primary = 0x3a; /* 0x74 >> 1*/
   130          const uint8_t hdcp_i2c_addr_link_secondary = 0x3b; /* 0x76 >> 1*/
   131          struct i2c_command i2c_command;
   132          uint8_t offset = hdcp_i2c_offsets[message_info->msg_id];
                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Potential out of bounds access.

   133          struct i2c_payload i2c_payloads[] = {
   134                  { true, 0, 1, &offset },
   135                  /* actual hdcp payload, will be filled later, zeroed for now*/
   136                  { 0 }
   137          };
   138

regards,
dan carpenter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/amd-gfx/attachments/20200416/a8094310/attachment-0001.htm>