linux-kernel - drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c:141:37: warning: Undefined behavior: Variable 'i2c_output' is used as parameter and destination in

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <202103121240.Yranw2E9-lkp@intel.com>
Date:   Fri, 12 Mar 2021 12:06:45 +0800
From:   kernel test robot <lkp@...el.com>
To:     Jinzhou Su <Jinzhou.Su@....com>
Cc:     kbuild-all@...ts.01.org, linux-kernel@...r.kernel.org,
        Alex Deucher <alexander.deucher@....com>,
        Huang Rui <ray.huang@....com>
Subject: drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c:141:37: warning:
 Undefined behavior: Variable 'i2c_output' is used as parameter and
 destination in

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   28806e4d9b97865b450d72156e9ad229f2067f0b
commit: ecaafb7b5ab6406587341d8727f237b3ee00dedf drm/amdgpu: Add secure display TA interface
date:   8 weeks ago
compiler: alpha-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>


cppcheck possible warnings: (new ones prefixed by >>, may not real problems)

>> drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c:141:37: warning: Undefined behavior: Variable 'i2c_output' is used as parameter and destination in s[n]printf(). [sprintfOverlappingData]
        sprintf(i2c_output, "%s 0x%X", i2c_output,
                                       ^

vim +/i2c_output +141 drivers/gpu/drm/amd/amdgpu/amdgpu_securedisplay.c

    85	
    86	static ssize_t amdgpu_securedisplay_debugfs_write(struct file *f, const char __user *buf,
    87			size_t size, loff_t *pos)
    88	{
    89		struct amdgpu_device *adev = (struct amdgpu_device *)file_inode(f)->i_private;
    90		struct psp_context *psp = &adev->psp;
    91		struct securedisplay_cmd *securedisplay_cmd;
    92		struct drm_device *dev = adev_to_drm(adev);
    93		uint32_t phy_id;
    94		uint32_t op;
    95		int i;
    96		char str[64];
    97		char i2c_output[256];
    98		int ret;
    99	
   100		if (*pos || size > sizeof(str) - 1)
   101			return -EINVAL;
   102	
   103		memset(str,  0, sizeof(str));
   104		ret = copy_from_user(str, buf, size);
   105		if (ret)
   106			return -EFAULT;
   107	
   108		ret = pm_runtime_get_sync(dev->dev);
   109		if (ret < 0) {
   110			pm_runtime_put_autosuspend(dev->dev);
   111			return ret;
   112		}
   113	
   114		if (size < 3)
   115			sscanf(str, "%u ", &op);
   116		else
   117			sscanf(str, "%u %u", &op, &phy_id);
   118	
   119		switch (op) {
   120		case 1:
   121			psp_prep_securedisplay_cmd_buf(psp, &securedisplay_cmd,
   122				TA_SECUREDISPLAY_COMMAND__QUERY_TA);
   123			ret = psp_securedisplay_invoke(psp, TA_SECUREDISPLAY_COMMAND__QUERY_TA);
   124			if (!ret) {
   125				if (securedisplay_cmd->status == TA_SECUREDISPLAY_STATUS__SUCCESS)
   126					dev_info(adev->dev, "SECUREDISPLAY: query securedisplay TA ret is 0x%X\n",
   127						securedisplay_cmd->securedisplay_out_message.query_ta.query_cmd_ret);
   128				else
   129					psp_securedisplay_parse_resp_status(psp, securedisplay_cmd->status);
   130			}
   131			break;
   132		case 2:
   133			psp_prep_securedisplay_cmd_buf(psp, &securedisplay_cmd,
   134				TA_SECUREDISPLAY_COMMAND__SEND_ROI_CRC);
   135			securedisplay_cmd->securedisplay_in_message.send_roi_crc.phy_id = phy_id;
   136			ret = psp_securedisplay_invoke(psp, TA_SECUREDISPLAY_COMMAND__SEND_ROI_CRC);
   137			if (!ret) {
   138				if (securedisplay_cmd->status == TA_SECUREDISPLAY_STATUS__SUCCESS) {
   139					memset(i2c_output,  0, sizeof(i2c_output));
   140					for (i = 0; i < TA_SECUREDISPLAY_I2C_BUFFER_SIZE; i++)
 > 141						sprintf(i2c_output, "%s 0x%X", i2c_output,
   142							securedisplay_cmd->securedisplay_out_message.send_roi_crc.i2c_buf[i]);
   143					dev_info(adev->dev, "SECUREDISPLAY: I2C buffer out put is :%s\n", i2c_output);
   144				} else {
   145					psp_securedisplay_parse_resp_status(psp, securedisplay_cmd->status);
   146				}
   147			}
   148			break;
   149		default:
   150			dev_err(adev->dev, "Invalid input: %s\n", str);
   151		}
   152	
   153		pm_runtime_mark_last_busy(dev->dev);
   154		pm_runtime_put_autosuspend(dev->dev);
   155	
   156		return size;
   157	}
   158	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org