From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild@lists.01.org, Alex Deucher <alexander.deucher@amd.com>
Cc: lkp@intel.com, kbuild-all@lists.01.org,
amd-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: [kbuild] drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1433 amdgpu_discovery_get_vcn_info() error: buffer overflow 'adev->vcn.vcn_codec_disable_mask' 2 <= 3
Date: Fri, 27 May 2022 10:46:22 +0300 [thread overview]
Message-ID: <202205271546.oV14N2r8-lkp@intel.com> (raw)
[ kbuild bot sent this warning on May 4 but I never heard back and it's
May 27 now so sending a duplicate warning is probably for the best. -dan]
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 7e284070abe53d448517b80493863595af4ab5f0
commit: 622469c87fc3e6c90a980be3e2287d82bd55c977 drm/amdgpu/discovery: add a function to parse the vcn info table
config: arc-randconfig-m031-20220524 (https://download.01.org/0day-ci/archive/20220527/202205271546.oV14N2r8-lkp@intel.com/config )
compiler: arceb-elf-gcc (GCC) 11.3.0
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1433 amdgpu_discovery_get_vcn_info() error: buffer overflow 'adev->vcn.vcn_codec_disable_mask' 2 <= 3
vim +1433 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
622469c87fc3e6 Alex Deucher 2022-03-30 1403 int amdgpu_discovery_get_vcn_info(struct amdgpu_device *adev)
622469c87fc3e6 Alex Deucher 2022-03-30 1404 {
622469c87fc3e6 Alex Deucher 2022-03-30 1405 struct binary_header *bhdr;
622469c87fc3e6 Alex Deucher 2022-03-30 1406 union vcn_info *vcn_info;
622469c87fc3e6 Alex Deucher 2022-03-30 1407 u16 offset;
622469c87fc3e6 Alex Deucher 2022-03-30 1408 int v;
622469c87fc3e6 Alex Deucher 2022-03-30 1409
622469c87fc3e6 Alex Deucher 2022-03-30 1410 if (!adev->mman.discovery_bin) {
622469c87fc3e6 Alex Deucher 2022-03-30 1411 DRM_ERROR("ip discovery uninitialized\n");
622469c87fc3e6 Alex Deucher 2022-03-30 1412 return -EINVAL;
622469c87fc3e6 Alex Deucher 2022-03-30 1413 }
622469c87fc3e6 Alex Deucher 2022-03-30 1414
622469c87fc3e6 Alex Deucher 2022-03-30 1415 if (adev->vcn.num_vcn_inst > VCN_INFO_TABLE_MAX_NUM_INSTANCES) {
Capped to 4
622469c87fc3e6 Alex Deucher 2022-03-30 1416 dev_err(adev->dev, "invalid vcn instances\n");
622469c87fc3e6 Alex Deucher 2022-03-30 1417 return -EINVAL;
622469c87fc3e6 Alex Deucher 2022-03-30 1418 }
622469c87fc3e6 Alex Deucher 2022-03-30 1419
622469c87fc3e6 Alex Deucher 2022-03-30 1420 bhdr = (struct binary_header *)adev->mman.discovery_bin;
622469c87fc3e6 Alex Deucher 2022-03-30 1421 offset = le16_to_cpu(bhdr->table_list[VCN_INFO].offset);
622469c87fc3e6 Alex Deucher 2022-03-30 1422
622469c87fc3e6 Alex Deucher 2022-03-30 1423 if (!offset) {
622469c87fc3e6 Alex Deucher 2022-03-30 1424 dev_err(adev->dev, "invalid vcn table offset\n");
622469c87fc3e6 Alex Deucher 2022-03-30 1425 return -EINVAL;
622469c87fc3e6 Alex Deucher 2022-03-30 1426 }
622469c87fc3e6 Alex Deucher 2022-03-30 1427
622469c87fc3e6 Alex Deucher 2022-03-30 1428 vcn_info = (union vcn_info *)(adev->mman.discovery_bin + offset);
622469c87fc3e6 Alex Deucher 2022-03-30 1429
622469c87fc3e6 Alex Deucher 2022-03-30 1430 switch (le16_to_cpu(vcn_info->v1.header.version_major)) {
622469c87fc3e6 Alex Deucher 2022-03-30 1431 case 1:
622469c87fc3e6 Alex Deucher 2022-03-30 1432 for (v = 0; v < adev->vcn.num_vcn_inst; v++) {
622469c87fc3e6 Alex Deucher 2022-03-30 @1433 adev->vcn.vcn_codec_disable_mask[v] =
But this array doesn't have 4 elements
622469c87fc3e6 Alex Deucher 2022-03-30 1434 le32_to_cpu(vcn_info->v1.instance_info[v].fuse_data.all_bits);
622469c87fc3e6 Alex Deucher 2022-03-30 1435 }
622469c87fc3e6 Alex Deucher 2022-03-30 1436 break;
622469c87fc3e6 Alex Deucher 2022-03-30 1437 default:
622469c87fc3e6 Alex Deucher 2022-03-30 1438 dev_err(adev->dev,
622469c87fc3e6 Alex Deucher 2022-03-30 1439 "Unhandled VCN info table %d.%d\n",
622469c87fc3e6 Alex Deucher 2022-03-30 1440 le16_to_cpu(vcn_info->v1.header.version_major),
622469c87fc3e6 Alex Deucher 2022-03-30 1441 le16_to_cpu(vcn_info->v1.header.version_minor));
622469c87fc3e6 Alex Deucher 2022-03-30 1442 return -EINVAL;
622469c87fc3e6 Alex Deucher 2022-03-30 1443 }
622469c87fc3e6 Alex Deucher 2022-03-30 1444 return 0;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1445 }
--
0-DAY CI Kernel Test Service
https://01.org/lkp
_______________________________________________
kbuild mailing list -- kbuild@lists.01.org
To unsubscribe send an email to kbuild-leave@lists.01.org
next reply other threads:[~2022-05-27 7:46 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-27 7:46 Dan Carpenter [this message]
2022-05-27 7:56 ` [kbuild] drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1433 amdgpu_discovery_get_vcn_info() error: buffer overflow 'adev->vcn.vcn_codec_disable_mask' 2 <= 3 Chen, Guchun
2022-05-27 8:12 ` Dan Carpenter
2022-06-01 18:43 ` Alex Deucher
[not found] ` <CAD=4a=WRbp8w4DA2c6hE7W5A2-woRyHLvtC-GPitFwQireCeNw@mail.gmail.com>
2022-06-02 11:50 ` Dan Carpenter
2022-06-02 14:24 ` Alex Deucher
2022-06-02 15:33 ` Dan Carpenter
2022-06-02 15:44 ` Alex Deucher
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202205271546.oV14N2r8-lkp@intel.com \
--to=dan.carpenter@oracle.com \
--cc=alexander.deucher@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=kbuild-all@lists.01.org \
--cc=kbuild@lists.01.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).