IronPort-SDR: DssgtsK2GaAksYToeW1onMO5MvUsSOMlLiyNRDvsKoGtjHpXIGR9IumFJLkWHietWagPpcIaEi
 5weGeM2O3UsCwEznDLCJLvz/5c9qkM6+6GHFaf1G/FnwOLARaKLGyRXCYaNwKqz6V/kEoy2Dnp
 fWUkn6sD1FNUkvkwLjY2WnTu/acEyaefpkoQS+/3DO66+ALnuhQMKok1BGXjziFtHP8UH7B6R+
 Vu9r82HBKc7ozsZWuSVJ2jHdKehMb4n7MNc52/JqbA/nC6w8wGBY04mvSocDHnqt91PQ87As3i
 +FU+LxYUgwydbqTRpmtjwNcG
MIME-Version: 1.0
From:   Yizhuo Zhai <yzhai003@ucr.edu>
Date:   Thu, 9 Dec 2021 00:02:35 -0800
Message-ID: <CABvMjLSXpg00KKkqXH35C7Op0xC3mPaOAhj_xbAOEXL_4Ys_aw@mail.gmail.com>
Subject: Potential Bug in drm/amd/display/dc_link
To:     harry.wentland@amd.com, sunpeng.li@amd.com,
        Rodrigo.Siqueira@amd.com, David Airlie <airlied@linux.ie>,
        Daniel Vetter <daniel@ffwll.ch>, amd-gfx@lists.freedesktop.org,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hi All:
I just found a bug in the cramfs using the static analysis tool, but
not sure if this could happen in reality, could you please advise me
here? Thanks for your attention : ) And please ignore the last one
with HTML format if you did not filter it out.

In function enable_stream_features(), the variable
"old_downspread.raw" could be uninitialized if core_link_read_dpcd
fails(), however, it is used in the later if statement, and further,
core_link_write_dpcd() may write random value, which is potentially
unsafe. But this function does not return the error code to the up
caller and I got stuck in drafting the patch, could you please advise
me here?

The related code:
static void enable_stream_features(struct pipe_ctx *pipe_ctx)
{
     union down_spread_ctrl old_downspread;
    core_link_read_dpcd(link, DP_DOWNSPREAD_CTRL,
                         &old_downspread.raw, sizeof(old_downspread);

        //old_downspread.raw used here
        if (new_downspread.raw != old_downspread.raw) {
               core_link_write_dpcd(link, DP_DOWNSPREAD_CTRL,
                         &new_downspread.raw, sizeof(new_downspread));
        }
}
enum dc_status core_link_read_dpcd(
    struct dc_link *link,
    uint32_t address,
    uint8_t *data,
    uint32_t size)
{
        //data could be uninitialized if the helpers fails and log
some error info
        if (!dm_helpers_dp_read_dpcd(link->ctx,
               link,address, data, size))
                      return DC_ERROR_UNEXPECTED;
        return DC_OK;
}

The same issue in function wait_for_training_aux_rd_interval() in
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
-- 
Kind Regards,

Yizhuo Zhai

Computer Science, Graduate Student
University of California, Riverside