linux-kernel - Re: [PATCH v2] drm/amdgpu: Avoid possible buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 21 Aug 2023 11:31:30 +0200
From:   Christian König <christian.koenig@....com>
To:     Su Hui <suhui@...china.com>, alexander.deucher@....com,
        Xinhui.Pan@....com, airlied@...il.com, daniel@...ll.ch
Cc:     Hawking.Zhang@....com, le.ma@....com, lijo.lazar@....com,
        yifan1.zhang@....com, candice.li@....com, guchun.chen@....com,
        Yuliang.Shi@....com, amd-gfx@...ts.freedesktop.org,
        dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
        kernel-janitors@...r.kernel.org, christophe.jaillet@...adoo.fr
Subject: Re: [PATCH v2] drm/amdgpu: Avoid possible buffer overflow

Am 21.08.23 um 09:37 schrieb Su Hui:
> smatch error:
> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1257 amdgpu_discovery_reg_base_init() error:
> testing array offset 'adev->vcn.num_vcn_inst' after use.
>
> change the assignment order to avoid buffer overflow.
>
> Fixes: c40bdfb2ffa4 ("drm/amdgpu: fix incorrect VCN revision in SRIOV")
> Signed-off-by: Su Hui <suhui@...china.com>
> ---
> changes in v2:
>   - fix the error about ip->revision (thanks to Christophe JAILLET).
>   drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> index 8e1cfc87122d..b07bfd106a9b 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
> @@ -1250,11 +1250,10 @@ static int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
>   				 *     0b10 : encode is disabled
>   				 *     0b01 : decode is disabled
>   				 */
> -				adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
> -					ip->revision & 0xc0;
> -				ip->revision &= ~0xc0;
>   				if (adev->vcn.num_vcn_inst <
>   				    AMDGPU_MAX_VCN_INSTANCES) {
> +					adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
> +						ip->revision & 0xc0;
>   					adev->vcn.num_vcn_inst++;
>   					adev->vcn.inst_mask |=
>   						(1U << ip->instance_number);
> @@ -1265,6 +1264,7 @@ static int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
>   						adev->vcn.num_vcn_inst + 1,
>   						AMDGPU_MAX_VCN_INSTANCES);
>   				}
> +				ip->revision &= ~0xc0;

That doesn't looks correct either. The assignment is intentionally 
outside of the "if".

See "adev->vcn.vcn_config[adev->vcn.num_vcn_inst] = ip->revision & 
0xc0;" is always valid.

We just avoid incrementing num_vcn_inst when we already have to many.

Regards,
Christian.


>   			}
>   			if (le16_to_cpu(ip->hw_id) == SDMA0_HWID ||
>   			    le16_to_cpu(ip->hw_id) == SDMA1_HWID ||