A Potential Bug in drm/amd/display/dc_link.c

[Yizhuo Zhai]

Hi All:
I just found a bug in the cramfs using the static analysis tool, but not
sure if this could happen in reality, could you please advisehere? Thanks
for your attention : )

In function enable_stream_features(), the variable "old_downspread.raw
<https://elixir.bootlin.com/linux/v4.18-rc1/source/drivers/gpu/drm/amd/display/dc/core/v4.18-rc1/C/ident/raw>"
could be uninitialized if core_link_read_dpcd fails(), however, it is used
in the later if statement, and further, core_link_write_dpcd() may write random
value, which is potentially unsafe. But this function does not return the
error code to the up caller and I got stuck in drafting the patch, could
you please advise me here?

The related code:

static void enable_stream_features(struct pipe_ctx *pipe_ctx)
{
	union down_spread_ctrl old_downspread;
	core_link_read_dpcd(link, DP_DOWNSPREAD_CTRL,
		&old_downspread.raw, sizeof(old_downspread);


        //old_downspread.raw
	if (new_downspread.raw != old_downspread.raw) {
		core_link_write_dpcd(link, DP_DOWNSPREAD_CTRL,
		&new_downspread.raw, sizeof(new_downspread));
	}
}
enum dc_status core_link_read_dpcd(
	struct dc_link *link,
	uint32_t address,
	uint8_t *data,
	uint32_t size)
{
        //data could be uninitialized if the helpers fails and log
some error info

	if (!dm_helpers_dp_read_dpcd(link->ctx,
			link,
			address, data, size))
			return DC_ERROR_UNEXPECTED;

	return DC_OK;
}


-- 
Kind Regards,

*Yizhuo Zhai*

*Computer Science, Graduate Student*
*University of California, Riverside *
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/amd-gfx/attachments/20211208/328edfa3/attachment-0001.htm>