2022-07-27 15:34:48

by Vijendar Mukunda

Subject: [PATCH] drm/amdgpu: fix i2s_pdata out of bound array access

Fixed following Smatch static checker warning:

drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:393 acp_hw_init()
error: buffer overflow 'i2s_pdata' 3 <= 3
drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:396 acp_hw_init()
error: buffer overflow 'i2s_pdata' 3 <= 3

Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Vijendar Mukunda <[email protected]>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 8 --------
1 file changed, 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
index bcc7ee02e0fc..6d72355ac492 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
@@ -390,14 +390,6 @@ static int acp_hw_init(void *handle)
i2s_pdata[2].i2s_reg_comp1 = ACP_BT_COMP1_REG_OFFSET;
i2s_pdata[2].i2s_reg_comp2 = ACP_BT_COMP2_REG_OFFSET;

- i2s_pdata[3].quirks = DW_I2S_QUIRK_COMP_REG_OFFSET;
- switch (adev->asic_type) {
- case CHIP_STONEY:
- i2s_pdata[3].quirks |= DW_I2S_QUIRK_16BIT_IDX_OVERRIDE;
- break;
- default:
- break;
- }
adev->acp.acp_res[0].name = "acp2x_dma";
adev->acp.acp_res[0].flags = IORESOURCE_MEM;
adev->acp.acp_res[0].start = acp_base;
--
2.25.1

2022-07-27 15:35:59

by Alex Deucher

Subject: Re: [PATCH] drm/amdgpu: fix i2s_pdata out of bound array access

On Wed, Jul 27, 2022 at 11:16 AM Mukunda,Vijendar
<[email protected]> wrote:
>
> On 7/27/22 8:25 PM, Alex Deucher wrote:
> > On Wed, Jul 27, 2022 at 10:42 AM Vijendar Mukunda
> > <[email protected]> wrote:
> >>
> >> Fixed following Smatch static checker warning:
> >>
> >> drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:393 acp_hw_init()
> >> error: buffer overflow 'i2s_pdata' 3 <= 3
> >> drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:396 acp_hw_init()
> >> error: buffer overflow 'i2s_pdata' 3 <= 3
> >>
> >> Reported-by: Dan Carpenter <[email protected]>
> >> Signed-off-by: Vijendar Mukunda <[email protected]>
> >> ---
> >> drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 8 --------
> >> 1 file changed, 8 deletions(-)
> >>
> >> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> >> index bcc7ee02e0fc..6d72355ac492 100644
> >> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> >> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> >> @@ -390,14 +390,6 @@ static int acp_hw_init(void *handle)
> >> i2s_pdata[2].i2s_reg_comp1 = ACP_BT_COMP1_REG_OFFSET;
> >> i2s_pdata[2].i2s_reg_comp2 = ACP_BT_COMP2_REG_OFFSET;
> >>
> >> - i2s_pdata[3].quirks = DW_I2S_QUIRK_COMP_REG_OFFSET;
> >> - switch (adev->asic_type) {
> >> - case CHIP_STONEY:
> >> - i2s_pdata[3].quirks |= DW_I2S_QUIRK_16BIT_IDX_OVERRIDE;
> >> - break;
> >> - default:
> >> - break;
> >> - }
> >
> > Is this actually not used or should we just increase the allocation size?
> >
> > Alex
> it's my bad. i2s_pdata array size is 3. when we recently included code
> changes for JD platform , this piece of code was added mistakenly for
> Stoney platform switch case.

Thanks. Patch is:
Acked-by: Alex Deucher <[email protected]>

>
> --
> Vijendar
>
> >
> >> adev->acp.acp_res[0].name = "acp2x_dma";
> >> adev->acp.acp_res[0].flags = IORESOURCE_MEM;
> >> adev->acp.acp_res[0].start = acp_base;
> >> --
> >> 2.25.1
> >>
>