| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202112031631.Op5iw0OJ-lkp@intel.com>
Date: Fri, 3 Dec 2021 13:42:27 +0300
From: Dan Carpenter <dan.carpenter@...cle.com>
To: kbuild@...ts.01.org, LUU HOAI <hoai.luu.ub@...esas.com>
Cc: lkp@...el.com, kbuild-all@...ts.01.org,
linux-kernel@...r.kernel.org,
Laurent Pinchart <laurent.pinchart+renesas@...asonboard.com>,
Kieran Bingham <kieran.bingham+renesas@...asonboard.com>
Subject: [kbuild] [pinchartl-media:drm/du/v3u/sn65dsi86 7/11]
drivers/gpu/drm/rcar-du/rcar_mipi_dsi.c:223 rcar_mipi_dsi_parameters_calc()
error: buffer overflow 'hsfreqrange_table' 64 <= 64
tree: git://linuxtv.org/pinchartl/media.git drm/du/v3u/sn65dsi86
head: b24450a25b8c342e517f8c5804755b060cd6e7dc
commit: 9315788ce032979d6b3affb603891ec69090be72 [7/11] drm: rcar-du: Add R-Car DSI driver
config: nios2-randconfig-m031-20211203 (https://download.01.org/0day-ci/archive/20211203/202112031631.Op5iw0OJ-lkp@intel.com/config )
compiler: nios2-linux-gcc (GCC) 11.2.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
New smatch warnings:
drivers/gpu/drm/rcar-du/rcar_mipi_dsi.c:223 rcar_mipi_dsi_parameters_calc() error: buffer overflow 'hsfreqrange_table' 64 <= 64
Old smatch warnings:
drivers/gpu/drm/rcar-du/rcar_mipi_dsi.c:224 rcar_mipi_dsi_parameters_calc() error: buffer overflow 'hsfreqrange_table' 64 <= 64
vim +/hsfreqrange_table +223 drivers/gpu/drm/rcar-du/rcar_mipi_dsi.c
9315788ce03297 LUU HOAI 2020-02-25 184 const struct vco_cntrl_value *vco_cntrl;
9315788ce03297 LUU HOAI 2020-02-25 185 unsigned long fout_target;
9315788ce03297 LUU HOAI 2020-02-25 186 unsigned long fin, fout;
9315788ce03297 LUU HOAI 2020-02-25 187 unsigned long hsfreq;
9315788ce03297 LUU HOAI 2020-02-25 188 unsigned int best_err = -1;
9315788ce03297 LUU HOAI 2020-02-25 189 unsigned int divider;
9315788ce03297 LUU HOAI 2020-02-25 190 unsigned int n;
9315788ce03297 LUU HOAI 2020-02-25 191 unsigned int i;
9315788ce03297 LUU HOAI 2020-02-25 192 unsigned int err;
9315788ce03297 LUU HOAI 2020-02-25 193
9315788ce03297 LUU HOAI 2020-02-25 194 /*
9315788ce03297 LUU HOAI 2020-02-25 195 * Calculate Fout = dot clock * ColorDepth / (2 * Lane Count)
9315788ce03297 LUU HOAI 2020-02-25 196 * The range out Fout is [40 - 1250] Mhz
9315788ce03297 LUU HOAI 2020-02-25 197 */
9315788ce03297 LUU HOAI 2020-02-25 198 fout_target = target * mipi_dsi_pixel_format_to_bpp(dsi->format)
9315788ce03297 LUU HOAI 2020-02-25 199 / (2 * dsi->lanes);
9315788ce03297 LUU HOAI 2020-02-25 200 if (fout_target < 40000000 || fout_target > 1250000000)
9315788ce03297 LUU HOAI 2020-02-25 201 return;
9315788ce03297 LUU HOAI 2020-02-25 202
9315788ce03297 LUU HOAI 2020-02-25 203 /* Find vco_cntrl */
9315788ce03297 LUU HOAI 2020-02-25 204 for (vco_cntrl = vco_cntrl_table; vco_cntrl->min_freq != 0; vco_cntrl++) {
9315788ce03297 LUU HOAI 2020-02-25 205 if (fout_target > vco_cntrl->min_freq &&
9315788ce03297 LUU HOAI 2020-02-25 206 fout_target <= vco_cntrl->max_freq) {
9315788ce03297 LUU HOAI 2020-02-25 207 setup_info->vco_cntrl = vco_cntrl->value;
9315788ce03297 LUU HOAI 2020-02-25 208 if (fout_target >= 1150000000)
9315788ce03297 LUU HOAI 2020-02-25 209 setup_info->prop_cntrl = 0x0c;
9315788ce03297 LUU HOAI 2020-02-25 210 else
9315788ce03297 LUU HOAI 2020-02-25 211 setup_info->prop_cntrl = 0x0b;
9315788ce03297 LUU HOAI 2020-02-25 212 break;
9315788ce03297 LUU HOAI 2020-02-25 213 }
9315788ce03297 LUU HOAI 2020-02-25 214 }
9315788ce03297 LUU HOAI 2020-02-25 215
9315788ce03297 LUU HOAI 2020-02-25 216 /* Add divider */
9315788ce03297 LUU HOAI 2020-02-25 217 setup_info->div = (setup_info->vco_cntrl & 0x30) >> 4;
9315788ce03297 LUU HOAI 2020-02-25 218
9315788ce03297 LUU HOAI 2020-02-25 219 /* Find hsfreqrange */
9315788ce03297 LUU HOAI 2020-02-25 220 hsfreq = fout_target * 2;
9315788ce03297 LUU HOAI 2020-02-25 221 for (i = 0; i < ARRAY_SIZE(hsfreqrange_table); i++) {
9315788ce03297 LUU HOAI 2020-02-25 222 if (hsfreq > hsfreqrange_table[i][0] &&
9315788ce03297 LUU HOAI 2020-02-25 @223 hsfreq <= hsfreqrange_table[i+1][0]) {
i+1 can read outside the array bounds. The hsfreqrange_table[] array
has a sentinal but it's not ever used. Maybe there was supposed to be
an "if (!hsfreqrange_table[i][0]) break;"?
9315788ce03297 LUU HOAI 2020-02-25 224 setup_info->hsfreqrange = hsfreqrange_table[i+1][1];
9315788ce03297 LUU HOAI 2020-02-25 225 break;
9315788ce03297 LUU HOAI 2020-02-25 226 }
9315788ce03297 LUU HOAI 2020-02-25 227 }
9315788ce03297 LUU HOAI 2020-02-25 228
9315788ce03297 LUU HOAI 2020-02-25 229 /*
9315788ce03297 LUU HOAI 2020-02-25 230 * Calculate n and m for PLL clock
9315788ce03297 LUU HOAI 2020-02-25 231 * Following the HW manual the ranges of n and m are
9315788ce03297 LUU HOAI 2020-02-25 232 * n = [3-8] and m = [64-625]
9315788ce03297 LUU HOAI 2020-02-25 233 */
9315788ce03297 LUU HOAI 2020-02-25 234 fin = clk_get_rate(clk);
9315788ce03297 LUU HOAI 2020-02-25 235 divider = 1 << setup_info->div;
9315788ce03297 LUU HOAI 2020-02-25 236 for (n = 3; n < 9; n++) {
9315788ce03297 LUU HOAI 2020-02-25 237 unsigned long fpfd;
9315788ce03297 LUU HOAI 2020-02-25 238 unsigned int m;
9315788ce03297 LUU HOAI 2020-02-25 239
9315788ce03297 LUU HOAI 2020-02-25 240 fpfd = fin / n;
9315788ce03297 LUU HOAI 2020-02-25 241
9315788ce03297 LUU HOAI 2020-02-25 242 for (m = 64; m < 626; m++) {
9315788ce03297 LUU HOAI 2020-02-25 243 fout = fpfd * m / divider;
9315788ce03297 LUU HOAI 2020-02-25 244 err = abs((long)(fout - fout_target) * 10000 /
9315788ce03297 LUU HOAI 2020-02-25 245 (long)fout_target);
9315788ce03297 LUU HOAI 2020-02-25 246 if (err < best_err) {
9315788ce03297 LUU HOAI 2020-02-25 247 setup_info->m = m - 2;
9315788ce03297 LUU HOAI 2020-02-25 248 setup_info->n = n - 1;
9315788ce03297 LUU HOAI 2020-02-25 249 setup_info->fout = fout;
9315788ce03297 LUU HOAI 2020-02-25 250 best_err = err;
9315788ce03297 LUU HOAI 2020-02-25 251 if (err == 0)
9315788ce03297 LUU HOAI 2020-02-25 252 goto done;
9315788ce03297 LUU HOAI 2020-02-25 253 }
9315788ce03297 LUU HOAI 2020-02-25 254 }
9315788ce03297 LUU HOAI 2020-02-25 255 }
9315788ce03297 LUU HOAI 2020-02-25 256
9315788ce03297 LUU HOAI 2020-02-25 257 done:
9315788ce03297 LUU HOAI 2020-02-25 258 dev_dbg(dsi->dev,
9315788ce03297 LUU HOAI 2020-02-25 259 "%pC %lu Hz -> Fout %lu Hz (target %lu Hz, error %d.%02u%%), PLL M/N/DIV %u/%u/%u\n",
9315788ce03297 LUU HOAI 2020-02-25 260 clk, fin, setup_info->fout, fout_target, best_err / 100,
9315788ce03297 LUU HOAI 2020-02-25 261 best_err % 100, setup_info->m, setup_info->n, setup_info->div);
9315788ce03297 LUU HOAI 2020-02-25 262 dev_dbg(dsi->dev,
9315788ce03297 LUU HOAI 2020-02-25 263 "vco_cntrl = 0x%x\tprop_cntrl = 0x%x\thsfreqrange = 0x%x\n",
9315788ce03297 LUU HOAI 2020-02-25 264 setup_info->vco_cntrl, setup_info->prop_cntrl,
9315788ce03297 LUU HOAI 2020-02-25 265 setup_info->hsfreqrange);
9315788ce03297 LUU HOAI 2020-02-25 266 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
_______________________________________________
kbuild mailing list -- kbuild@...ts.01.org
To unsubscribe send an email to kbuild-leave@...ts.01.org
Powered by blists - more mailing lists