<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<p style="font-family:Arial;font-size:10pt;color:#0078D7;margin:15pt;" align="Left">
[AMD Official Use Only - Internal Distribution Only]<br>
</p>
<br>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I will look into it, thanks.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Bhawan<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Dan Carpenter <dan.carpenter@oracle.com><br>
<b>Sent:</b> April 16, 2020 9:24 AM<br>
<b>To:</b> Lakha, Bhawanpreet <Bhawanpreet.Lakha@amd.com><br>
<b>Cc:</b> amd-gfx@lists.freedesktop.org <amd-gfx@lists.freedesktop.org><br>
<b>Subject:</b> [bug report] drm/amd/display: Add HDCP module</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hello Bhawanpreet Lakha,<br>
<br>
The patch 4c283fdac08a: "drm/amd/display: Add HDCP module" from Aug<br>
6, 2019, leads to the following static checker warning:<br>
<br>
drivers/gpu/drm/amd/amdgpu/../display/dc/hdcp/hdcp_msg.c:132 hdmi_14_process_transaction()<br>
error: buffer overflow 'hdcp_i2c_offsets' 32 <= 32<br>
<br>
drivers/gpu/drm/amd/amdgpu/../display/dc/hdcp/hdcp_msg.c<br>
77 <br>
78 static const uint8_t hdcp_i2c_offsets[] = {<br>
79 [HDCP_MESSAGE_ID_READ_BKSV] = 0x0,<br>
80 [HDCP_MESSAGE_ID_READ_RI_R0] = 0x8,<br>
81 [HDCP_MESSAGE_ID_READ_PJ] = 0xA,<br>
82 [HDCP_MESSAGE_ID_WRITE_AKSV] = 0x10,<br>
83 [HDCP_MESSAGE_ID_WRITE_AINFO] = 0x15,<br>
84 [HDCP_MESSAGE_ID_WRITE_AN] = 0x18,<br>
85 [HDCP_MESSAGE_ID_READ_VH_X] = 0x20,<br>
86 [HDCP_MESSAGE_ID_READ_VH_0] = 0x20,<br>
87 [HDCP_MESSAGE_ID_READ_VH_1] = 0x24,<br>
88 [HDCP_MESSAGE_ID_READ_VH_2] = 0x28,<br>
89 [HDCP_MESSAGE_ID_READ_VH_3] = 0x2C,<br>
90 [HDCP_MESSAGE_ID_READ_VH_4] = 0x30,<br>
91 [HDCP_MESSAGE_ID_READ_BCAPS] = 0x40,<br>
92 [HDCP_MESSAGE_ID_READ_BSTATUS] = 0x41,<br>
93 [HDCP_MESSAGE_ID_READ_KSV_FIFO] = 0x43,<br>
94 [HDCP_MESSAGE_ID_READ_BINFO] = 0xFF,<br>
95 [HDCP_MESSAGE_ID_HDCP2VERSION] = 0x50,<br>
96 [HDCP_MESSAGE_ID_WRITE_AKE_INIT] = 0x60,<br>
97 [HDCP_MESSAGE_ID_READ_AKE_SEND_CERT] = 0x80,<br>
98 [HDCP_MESSAGE_ID_WRITE_AKE_NO_STORED_KM] = 0x60,<br>
99 [HDCP_MESSAGE_ID_WRITE_AKE_STORED_KM] = 0x60,<br>
100 [HDCP_MESSAGE_ID_READ_AKE_SEND_H_PRIME] = 0x80,<br>
101 [HDCP_MESSAGE_ID_READ_AKE_SEND_PAIRING_INFO] = 0x80,<br>
102 [HDCP_MESSAGE_ID_WRITE_LC_INIT] = 0x60,<br>
103 [HDCP_MESSAGE_ID_READ_LC_SEND_L_PRIME] = 0x80,<br>
104 [HDCP_MESSAGE_ID_WRITE_SKE_SEND_EKS] = 0x60,<br>
105 [HDCP_MESSAGE_ID_READ_REPEATER_AUTH_SEND_RECEIVERID_LIST] = 0x80,<br>
106 [HDCP_MESSAGE_ID_WRITE_REPEATER_AUTH_SEND_ACK] = 0x60,<br>
107 [HDCP_MESSAGE_ID_WRITE_REPEATER_AUTH_STREAM_MANAGE] = 0x60,<br>
108 [HDCP_MESSAGE_ID_READ_REPEATER_AUTH_STREAM_READY] = 0x80,<br>
109 [HDCP_MESSAGE_ID_READ_RXSTATUS] = 0x70<br>
<br>
HDCP_MESSAGE_ID_WRITE_CONTENT_STREAM_TYPE is missing. This array should<br>
have HDCP_MESSAGE_ID_MAX elements.<br>
<br>
110 };<br>
111 <br>
112 struct protection_properties {<br>
113 bool supported;<br>
114 bool (*process_transaction)(<br>
115 struct dc_link *link,<br>
116 struct hdcp_protection_message *message_info);<br>
117 };<br>
118 <br>
119 static const struct protection_properties non_supported_protection = {<br>
120 .supported = false<br>
121 };<br>
122 <br>
123 static bool hdmi_14_process_transaction(<br>
124 struct dc_link *link,<br>
125 struct hdcp_protection_message *message_info)<br>
126 {<br>
127 uint8_t *buff = NULL;<br>
128 bool result;<br>
129 const uint8_t hdcp_i2c_addr_link_primary = 0x3a; /* 0x74 >> 1*/<br>
130 const uint8_t hdcp_i2c_addr_link_secondary = 0x3b; /* 0x76 >> 1*/<br>
131 struct i2c_command i2c_command;<br>
132 uint8_t offset = hdcp_i2c_offsets[message_info->msg_id];<br>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^<br>
Potential out of bounds access.<br>
<br>
133 struct i2c_payload i2c_payloads[] = {<br>
134 { true, 0, 1, &offset },<br>
135 /* actual hdcp payload, will be filled later, zeroed for now*/<br>
136 { 0 }<br>
137 };<br>
138 <br>
<br>
regards,<br>
dan carpenter<br>
</div>
</span></font></div>
</div>
</body>
</html>