[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <7ac675b6-a000-6ad7-36f3-a3ce186414b6@wanadoo.fr>
Date: Mon, 21 Aug 2023 08:47:51 +0200
From: Christophe JAILLET <christophe.jaillet@...adoo.fr>
To: Su Hui <suhui@...china.com>, alexander.deucher@....com,
christian.koenig@....com, Xinhui.Pan@....com, airlied@...il.com,
daniel@...ll.ch
Cc: Hawking.Zhang@....com, le.ma@....com, lijo.lazar@....com,
yifan1.zhang@....com, candice.li@....com, Yuliang.Shi@....com,
guchun.chen@....com, amd-gfx@...ts.freedesktop.org,
dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
kernel-janitors@...r.kernel.org
Subject: Re: [PATCH] drm/amdgpu: Avoid possible buffer overflow
Le 21/08/2023 à 08:19, Su Hui a écrit :
> smatch error:
> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1257 amdgpu_discovery_reg_base_init() error:
> testing array offset 'adev->vcn.num_vcn_inst' after use.
>
> change the assignment order to avoid buffer overflow.
>
> Fixes: c40bdfb2ffa4 ("drm/amdgpu: fix incorrect VCN revision in SRIOV")
> Signed-off-by: Su Hui <suhui@...china.com>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> index 8e1cfc87122d..ba95526c3d45 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> @@ -1250,11 +1250,12 @@ static int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
> * 0b10 : encode is disabled
> * 0b01 : decode is disabled
> */
> - adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
> - ip->revision & 0xc0;
> +
> ip->revision &= ~0xc0;
> if (adev->vcn.num_vcn_inst <
> AMDGPU_MAX_VCN_INSTANCES) {
> + adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
> + ip->revision & 0xc0;
Hi,
I don't think that the patch is correct.
Because of the "ip->revision &= ~0xc0" which is now above it,
"ip->revision & 0xc0" should now always be 0.
Maybe both lines should be moved within the "if"?
CJ
> adev->vcn.num_vcn_inst++;
> adev->vcn.inst_mask |=
> (1U << ip->instance_number);
Powered by blists - more mailing lists