| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202206120158.qKV3o9Lh-lkp@intel.com>
Date: Mon, 13 Jun 2022 17:23:21 +0300
From: Dan Carpenter <dan.carpenter@...cle.com>
To: kbuild@...ts.01.org, Alex Deucher <alexander.deucher@....com>
Cc: lkp@...el.com, kbuild-all@...ts.01.org,
linux-kernel@...r.kernel.org, Guchun Chen <guchun.chen@....com>
Subject: drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1133
amdgpu_discovery_reg_base_init() error: testing array offset
'adev->vcn.num_vcn_inst' after use.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 0885eacdc81f920c3e0554d5615e69a66504a28d
commit: a0ccc717c4ab3ef572f023fdceffb4b6df496a0d drm/amdgpu/discovery: validate VCN and SDMA instances
config: parisc-randconfig-m031-20220608 (https://download.01.org/0day-ci/archive/20220612/202206120158.qKV3o9Lh-lkp@intel.com/config)
compiler: hppa-linux-gcc (GCC) 11.3.0
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
New smatch warnings:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1133 amdgpu_discovery_reg_base_init() error: testing array offset 'adev->vcn.num_vcn_inst' after use.
Old smatch warnings:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1454 amdgpu_discovery_get_vcn_info() error: buffer overflow 'adev->vcn.vcn_codec_disable_mask' 2 <= 3
vim +1133 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
e24d0e91b33676 Alex Deucher 2022-03-30 1065 static int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1066 {
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1067 struct binary_header *bhdr;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1068 struct ip_discovery_header *ihdr;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1069 struct die_header *dhdr;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1070 struct ip *ip;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1071 uint16_t die_offset;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1072 uint16_t ip_offset;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1073 uint16_t num_dies;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1074 uint16_t num_ips;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1075 uint8_t num_base_address;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1076 int hw_ip;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1077 int i, j, k;
dffa11b4f74b15 Monk Liu 2020-03-04 1078 int r;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1079
dffa11b4f74b15 Monk Liu 2020-03-04 1080 r = amdgpu_discovery_init(adev);
dffa11b4f74b15 Monk Liu 2020-03-04 1081 if (r) {
dffa11b4f74b15 Monk Liu 2020-03-04 1082 DRM_ERROR("amdgpu_discovery_init failed\n");
dffa11b4f74b15 Monk Liu 2020-03-04 1083 return r;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1084 }
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1085
72de33f8f7ba0f Alex Deucher 2020-07-29 1086 bhdr = (struct binary_header *)adev->mman.discovery_bin;
72de33f8f7ba0f Alex Deucher 2020-07-29 1087 ihdr = (struct ip_discovery_header *)(adev->mman.discovery_bin +
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1088 le16_to_cpu(bhdr->table_list[IP_DISCOVERY].offset));
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1089 num_dies = le16_to_cpu(ihdr->num_dies);
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1090
437298b833996d Xiaojie Yuan 2019-03-27 1091 DRM_DEBUG("number of dies: %d\n", num_dies);
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1092
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1093 for (i = 0; i < num_dies; i++) {
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1094 die_offset = le16_to_cpu(ihdr->die_info[i].die_offset);
72de33f8f7ba0f Alex Deucher 2020-07-29 1095 dhdr = (struct die_header *)(adev->mman.discovery_bin + die_offset);
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1096 num_ips = le16_to_cpu(dhdr->num_ips);
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1097 ip_offset = die_offset + sizeof(*dhdr);
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1098
437298b833996d Xiaojie Yuan 2019-03-27 1099 if (le16_to_cpu(dhdr->die_id) != i) {
437298b833996d Xiaojie Yuan 2019-03-27 1100 DRM_ERROR("invalid die id %d, expected %d\n",
437298b833996d Xiaojie Yuan 2019-03-27 1101 le16_to_cpu(dhdr->die_id), i);
437298b833996d Xiaojie Yuan 2019-03-27 1102 return -EINVAL;
437298b833996d Xiaojie Yuan 2019-03-27 1103 }
437298b833996d Xiaojie Yuan 2019-03-27 1104
437298b833996d Xiaojie Yuan 2019-03-27 1105 DRM_DEBUG("number of hardware IPs on die%d: %d\n",
437298b833996d Xiaojie Yuan 2019-03-27 1106 le16_to_cpu(dhdr->die_id), num_ips);
437298b833996d Xiaojie Yuan 2019-03-27 1107
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1108 for (j = 0; j < num_ips; j++) {
72de33f8f7ba0f Alex Deucher 2020-07-29 1109 ip = (struct ip *)(adev->mman.discovery_bin + ip_offset);
5039f5298880f7 Ernst Sjöstrand 2021-09-26 1110
5039f5298880f7 Ernst Sjöstrand 2021-09-26 1111 if (amdgpu_discovery_validate_ip(ip))
5039f5298880f7 Ernst Sjöstrand 2021-09-26 1112 goto next_ip;
5039f5298880f7 Ernst Sjöstrand 2021-09-26 1113
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1114 num_base_address = ip->num_base_address;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1115
437298b833996d Xiaojie Yuan 2019-03-27 1116 DRM_DEBUG("%s(%d) #%d v%d.%d.%d:\n",
437298b833996d Xiaojie Yuan 2019-03-27 1117 hw_id_names[le16_to_cpu(ip->hw_id)],
437298b833996d Xiaojie Yuan 2019-03-27 1118 le16_to_cpu(ip->hw_id),
437298b833996d Xiaojie Yuan 2019-03-27 1119 ip->number_instance,
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1120 ip->major, ip->minor,
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1121 ip->revision);
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20 1122
baf3f8f3740625 Alex Deucher 2021-11-30 1123 if (le16_to_cpu(ip->hw_id) == VCN_HWID) {
c40bdfb2ffa4cf Leslie Shi 2021-12-08 1124 /* Bit [5:0]: original revision value
baf3f8f3740625 Alex Deucher 2021-11-30 1125 * Bit [7:6]: en/decode capability:
baf3f8f3740625 Alex Deucher 2021-11-30 1126 * 0b00 : VCN function normally
baf3f8f3740625 Alex Deucher 2021-11-30 1127 * 0b10 : encode is disabled
baf3f8f3740625 Alex Deucher 2021-11-30 1128 * 0b01 : decode is disabled
baf3f8f3740625 Alex Deucher 2021-11-30 1129 */
c40bdfb2ffa4cf Leslie Shi 2021-12-08 1130 adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
c40bdfb2ffa4cf Leslie Shi 2021-12-08 1131 ip->revision & 0xc0;
baf3f8f3740625 Alex Deucher 2021-11-30 1132 ip->revision &= ~0xc0;
a0ccc717c4ab3e Alex Deucher 2022-05-16 @1133 if (adev->vcn.num_vcn_inst < AMDGPU_MAX_VCN_INSTANCES)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If "adev->vcn.num_vcn_inst >= AMDGPU_MAX_VCN_INSTANCES" then the memory
has already been corrupted.
7cbe08a930a132 Alex Deucher 2021-08-09 1134 adev->vcn.num_vcn_inst++;
a0ccc717c4ab3e Alex Deucher 2022-05-16 1135 else
a0ccc717c4ab3e Alex Deucher 2022-05-16 1136 dev_err(adev->dev, "Too many VCN instances: %d vs %d\n",
a0ccc717c4ab3e Alex Deucher 2022-05-16 1137 adev->vcn.num_vcn_inst + 1,
a0ccc717c4ab3e Alex Deucher 2022-05-16 1138 AMDGPU_MAX_VCN_INSTANCES);
baf3f8f3740625 Alex Deucher 2021-11-30 1139 }
--
0-DAY CI Kernel Test Service
https://01.org/lkp
Powered by blists - more mailing lists