[kbuild] drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1433 amdgpu_discovery_get_vcn_info() error: buffer overflow 'adev->vcn.vcn_codec_disable_mask' 2 <= 3
Ernst Sjöstrand
ernstp at gmail.com
Thu Jun 2 06:26:03 UTC 2022
Dan: I also ran Smatch which resulted in the following discussion:
https://lists.freedesktop.org/archives/amd-gfx/2022-May/079228.html
Regards
Den ons 1 juni 2022 kl 20:44 skrev Alex Deucher <alexdeucher at gmail.com>:
> On Fri, May 27, 2022 at 3:46 AM Dan Carpenter <dan.carpenter at oracle.com>
> wrote:
> >
> > [ kbuild bot sent this warning on May 4 but I never heard back and it's
> > May 27 now so sending a duplicate warning is probably for the best.
> -dan]
> >
> > tree:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> > head: 7e284070abe53d448517b80493863595af4ab5f0
> > commit: 622469c87fc3e6c90a980be3e2287d82bd55c977 drm/amdgpu/discovery:
> add a function to parse the vcn info table
> > config: arc-randconfig-m031-20220524 (
> https://download.01.org/0day-ci/archive/20220527/202205271546.oV14N2r8-lkp@intel.com/config
> )
> > compiler: arceb-elf-gcc (GCC) 11.3.0
> >
> > If you fix the issue, kindly add following tag where applicable
> > Reported-by: kernel test robot <lkp at intel.com>
> > Reported-by: Dan Carpenter <dan.carpenter at oracle.com>
> >
> > smatch warnings:
> > drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1433
> amdgpu_discovery_get_vcn_info() error: buffer overflow
> 'adev->vcn.vcn_codec_disable_mask' 2 <= 3
> >
> > vim +1433 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> >
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1403 int
> amdgpu_discovery_get_vcn_info(struct amdgpu_device *adev)
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1404 {
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1405 struct binary_header
> *bhdr;
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1406 union vcn_info *vcn_info;
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1407 u16 offset;
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1408 int v;
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1409
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1410 if
> (!adev->mman.discovery_bin) {
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1411 DRM_ERROR("ip
> discovery uninitialized\n");
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1412 return -EINVAL;
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1413 }
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1414
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1415 if
> (adev->vcn.num_vcn_inst > VCN_INFO_TABLE_MAX_NUM_INSTANCES) {
> >
> > Capped to 4
> >
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1416
> dev_err(adev->dev, "invalid vcn instances\n");
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1417 return -EINVAL;
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1418 }
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1419
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1420 bhdr = (struct
> binary_header *)adev->mman.discovery_bin;
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1421 offset =
> le16_to_cpu(bhdr->table_list[VCN_INFO].offset);
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1422
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1423 if (!offset) {
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1424
> dev_err(adev->dev, "invalid vcn table offset\n");
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1425 return -EINVAL;
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1426 }
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1427
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1428 vcn_info = (union
> vcn_info *)(adev->mman.discovery_bin + offset);
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1429
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1430 switch
> (le16_to_cpu(vcn_info->v1.header.version_major)) {
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1431 case 1:
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1432 for (v = 0; v <
> adev->vcn.num_vcn_inst; v++) {
> > 622469c87fc3e6 Alex Deucher 2022-03-30 @1433
> adev->vcn.vcn_codec_disable_mask[v] =
> >
> > But this array doesn't have 4 elements
>
> Correct, but num_vcn_inst can't be larger than
> AMDGPU_MAX_VCN_INSTANCES (2) at the moment thanks to:
> https://patchwork.freedesktop.org/patch/486289/
>
> Alex
>
> >
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1434
> le32_to_cpu(vcn_info->v1.instance_info[v].fuse_data.all_bits);
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1435 }
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1436 break;
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1437 default:
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1438
> dev_err(adev->dev,
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1439
> "Unhandled VCN info table %d.%d\n",
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1440
> le16_to_cpu(vcn_info->v1.header.version_major),
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1441
> le16_to_cpu(vcn_info->v1.header.version_minor));
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1442 return -EINVAL;
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1443 }
> > 622469c87fc3e6 Alex Deucher 2022-03-30 1444 return 0;
> > f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1445 }
> >
> > --
> > 0-DAY CI Kernel Test Service
> > https://01.org/lkp
> > _______________________________________________
> > kbuild mailing list -- kbuild at lists.01.org
> > To unsubscribe send an email to kbuild-leave at lists.01.org
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/amd-gfx/attachments/20220602/21d453bb/attachment-0001.htm>
More information about the amd-gfx
mailing list