2022-07-27 15:01:06

by Alex Deucher

Subject: Re: [PATCH] drm/amdgpu: fix i2s_pdata out of bound array access

On Wed, Jul 27, 2022 at 10:42 AM Vijendar Mukunda
<[email protected]> wrote:
>
> Fixed following Smatch static checker warning:
>
> drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:393 acp_hw_init()
> error: buffer overflow 'i2s_pdata' 3 <= 3
> drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:396 acp_hw_init()
> error: buffer overflow 'i2s_pdata' 3 <= 3
>
> Reported-by: Dan Carpenter <[email protected]>
> Signed-off-by: Vijendar Mukunda <[email protected]>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 8 --------
> 1 file changed, 8 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> index bcc7ee02e0fc..6d72355ac492 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> @@ -390,14 +390,6 @@ static int acp_hw_init(void *handle)
> i2s_pdata[2].i2s_reg_comp1 = ACP_BT_COMP1_REG_OFFSET;
> i2s_pdata[2].i2s_reg_comp2 = ACP_BT_COMP2_REG_OFFSET;
>
> - i2s_pdata[3].quirks = DW_I2S_QUIRK_COMP_REG_OFFSET;
> - switch (adev->asic_type) {
> - case CHIP_STONEY:
> - i2s_pdata[3].quirks |= DW_I2S_QUIRK_16BIT_IDX_OVERRIDE;
> - break;
> - default:
> - break;
> - }

Is this actually not used or should we just increase the allocation size?

Alex

> adev->acp.acp_res[0].name = "acp2x_dma";
> adev->acp.acp_res[0].flags = IORESOURCE_MEM;
> adev->acp.acp_res[0].start = acp_base;
> --
> 2.25.1
>

2022-07-27 15:48:59

by Vijendar Mukunda

Subject: Re: [PATCH] drm/amdgpu: fix i2s_pdata out of bound array access

On 7/27/22 8:25 PM, Alex Deucher wrote:
> On Wed, Jul 27, 2022 at 10:42 AM Vijendar Mukunda
> <[email protected]> wrote:
>>
>> Fixed following Smatch static checker warning:
>>
>> drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:393 acp_hw_init()
>> error: buffer overflow 'i2s_pdata' 3 <= 3
>> drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:396 acp_hw_init()
>> error: buffer overflow 'i2s_pdata' 3 <= 3
>>
>> Reported-by: Dan Carpenter <[email protected]>
>> Signed-off-by: Vijendar Mukunda <[email protected]>
>> ---
>> drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 8 --------
>> 1 file changed, 8 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
>> index bcc7ee02e0fc..6d72355ac492 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
>> @@ -390,14 +390,6 @@ static int acp_hw_init(void *handle)
>> i2s_pdata[2].i2s_reg_comp1 = ACP_BT_COMP1_REG_OFFSET;
>> i2s_pdata[2].i2s_reg_comp2 = ACP_BT_COMP2_REG_OFFSET;
>>
>> - i2s_pdata[3].quirks = DW_I2S_QUIRK_COMP_REG_OFFSET;
>> - switch (adev->asic_type) {
>> - case CHIP_STONEY:
>> - i2s_pdata[3].quirks |= DW_I2S_QUIRK_16BIT_IDX_OVERRIDE;
>> - break;
>> - default:
>> - break;
>> - }
>
> Is this actually not used or should we just increase the allocation size?
>
> Alex
it's my bad. i2s_pdata array size is 3. when we recently included code
changes for JD platform , this piece of code was added mistakenly for
Stoney platform switch case.

--
Vijendar

>
>> adev->acp.acp_res[0].name = "acp2x_dma";
>> adev->acp.acp_res[0].flags = IORESOURCE_MEM;
>> adev->acp.acp_res[0].start = acp_base;
>> --
>> 2.25.1
>>