Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Message-ID: <dc52f807-f4bc-13d6-7b9e-81b4fe94a6e0@intel.com>
Date:   Wed, 18 May 2022 09:57:16 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Firefox/91.0 Thunderbird/91.9.0
Subject: Re: [PATCH] drm: bridge: sii8620: fix possible off-by-one
Content-Language: en-US
To:     Hangyu Hua <hbh25y@gmail.com>, <narmstrong@baylibre.com>,
        <robert.foss@linaro.org>, <Laurent.pinchart@ideasonboard.com>,
        <jonas@kwiboo.se>, <jernej.skrabec@gmail.com>, <airlied@linux.ie>,
        <daniel@ffwll.ch>, <architt@codeaurora.org>
CC:     <dri-devel@lists.freedesktop.org>, <linux-kernel@vger.kernel.org>
References: <20220518065856.18936-1-hbh25y@gmail.com>
From:   Andrzej Hajda <andrzej.hajda@intel.com>
Organization: Intel Technology Poland sp. z o.o. - ul. Slowackiego 173, 80-298
 Gdansk - KRS 101882 - NIP 957-07-52-316
In-Reply-To: <20220518065856.18936-1-hbh25y@gmail.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?cnJJTy9XUm43dzEzYzBPR29xZzloYTZFSFRxTnlKaGp2U2VFVllJSE9WOUdS?=
 =?utf-8?B?MFZ6ZzBtOHI5R3FJaGZzNXNrVkhQa3pPZmkxSkJKYmRTVFRlR0x4TU5sbnpq?=
 =?utf-8?B?ZVlaWlltSHV3S2NpQk1KNkJjWS9tV05DT2RuM1dCOVVqUkQrcTBpS1J1WW9W?=
 =?utf-8?B?d0pCeHlqK0ZnRms5K3hOU2VQU2tsOTE2ZStiOHNiMmplZ0NubDQ5L1JldUxv?=
 =?utf-8?B?eWQwZGszY2hzbHpkRkVWS0pkaGNGQjJQdDdzdjB4cEZGeXorUll4SHMwMklT?=
 =?utf-8?B?dEFtWkRnckRVMmhCZmFMSDNkY0x5RHBPKzBYK3NyRzJyUzZzR1RBSWI4MCtk?=
 =?utf-8?B?UklpQnF6b3ArQUVSbUlFR3Bvd3I4bVZyWXdESk5YRUFnQ01DRDhReVM1c3hK?=
 =?utf-8?B?VTB3Sm95cnFRYnNpYTFUa1NwcFNTUUd1dS8vTlJuUEd3YmljdHNXWnp5dGIx?=
 =?utf-8?B?M1A1ZnU4Z2ZjelR5eU52VTFuRDRmOXlHSEhvZE1lOElJWHB5eXhMVjQrSXZD?=
 =?utf-8?B?b3ZGK3dQS0JhNWwyZ0QzSzdYaU04VHpuMnY4a3NDUlQ1V0d6ZlJqeGZpYkVv?=
 =?utf-8?B?enhzNE9aZlhaRno3MnFGMU1nd2lTaklyaXJsbVBzTlZFQnhFVnp5MHpERXhM?=
 =?utf-8?B?SGh3eGpyVGZkWkYzQ3BobzdTb1IwTHN4R3lVa0FyNFU5WWJTVUVESlRhUmRW?=
 =?utf-8?B?VGxYVUR5Wm9jSmp5WHF6SVBsV3lxQU0vV0Q1aDYraHZVYjlFS3BLaDVieGF2?=
 =?utf-8?B?OWdtTW5uN0QxVnBFWlNOcDlBNXZXTFlrWmhPRWViOElweG52SURNWkhjMS9H?=
 =?utf-8?B?c3E5anprWXhXbkhBM3lZZUxuWGtYK0pzN25EQ3o2Y08yckE1QXRqcWliTU1W?=
 =?utf-8?B?Qm4yOFNHdlhweThKdmJPeGk2QzFlNnFFQytaTFA2OHR3alFIbTloaGhTU0c4?=
 =?utf-8?B?Q21zZjNKTHBUcFBGUUJuQVNXcWswTTZ6YVVVVGRFV29ZdmhJd2hiLzYybk9T?=
 =?utf-8?B?eWNXWC8xM1oyNFdBc0RXSFdvd3dDeWw1UEJMWGs5Z3dxL3VjUmlIQm1iTVBM?=
 =?utf-8?B?SklkdVgzSWhnREc0R3owRDRkYTR2KzlHRmE1emp1blhVTk9qS0NaVVlPcjY3?=
 =?utf-8?B?aTMvbnd1S20yUE82NXBwa0pOZVg1R2FGZCtRN2F0bks5Zmsyd25sTGhoMTRa?=
 =?utf-8?B?emtDS1BrU3RodXp0N1VOOW1VNTFpSUZpNE8wRStXQk45cmhHR21wUXR0aVV0?=
 =?utf-8?B?L1V3S3c5MWs3ZDNhN0RPM0s1b3JPRXFNK2RjNWhleEtjN09JTWg3NGpsNkJ2?=
 =?utf-8?B?TVo2RVBDVmxnY1RpNHpGYWhOdm52bFRMb0tBUVVINTFrOG9ITkRGOGw0cWJ0?=
 =?utf-8?B?K2lzN1JlUzd6aCtHeHZCdlppUk9XMnlqcUo2TExLVGY1QStDRE1Cc1MyWklk?=
 =?utf-8?B?aHEvdmxQMlUwMTBpenVGVnljRGtoODNMR3lHWGxjT0lTdk9Fd2JjVkg4U1Ju?=
 =?utf-8?B?WWg5ZFhFc2F6bjkyZWhSTzBPSFJzdnBmYXBmUUlNcXpOU3d1UU5qb3NucVBV?=
 =?utf-8?B?WDF4b0ZuWllhOWNtWGJVWWdrQzlNRzlMQ3VTdy9Rd1VtQmp0N1pVbDQ2VHh3?=
 =?utf-8?B?VytBSFhCMTlWZWhRemR6YVJHZGxjNHMvT0l2bjFabE02UGMyenhmeks3azcw?=
 =?utf-8?B?aEhrV3J4Zk8rTDMrOTZuT3pzcXlSZ3hHd3NabE92MTR3UXdYTFhkaWxyVXR3?=
 =?utf-8?B?UE1wRm16MGJsbGVPaHcyeHh5Z2Rmd2d2Z1JNWUtMMi8rMHc4eWRaVStrZDVI?=
 =?utf-8?B?VUpzTWJOcDFXbU1TUnNCRWxGUVdUUlRpM2ZuNkhNbXEzMW43TzN4My96NTNQ?=
 =?utf-8?B?YmNRL0ZzRFFIb1RlUFZpdDF5Wnd1TWVTRlJUcFFVTGxpNUFsbUIzWGNmcnJU?=
 =?utf-8?B?dEdSWFpRWEM3NGJuQ3Qxa0xEUGlRaS90MXNNOGQydFF6c0hVMUZYdFJEaTRN?=
 =?utf-8?B?WTQ0eGxyZEhldXVqK0cxTkRGaWI4L1Vubjh2UEhULy9XTk5EOXVHRkxickhW?=
 =?utf-8?B?MTRMWTMraGRtakF5b0hPWlZGYXVacXgwTUtUQXpQSEZsMUlOUjVSR0pESk5F?=
 =?utf-8?B?cnBRSklVQ3duV281ZlhVWW9oZjU1K0NzTkVTWnFYbmtOK1dQSHJxZERoVU9h?=
 =?utf-8?B?TERNa2Z6dkw3ZS8vak1WemYyZU0vczl0Qmh1SVdxN3VMQ0htYWQrK0J5bUQw?=
 =?utf-8?B?VkZwek5BTFE3UU9waDNDN1UzNUF4NlRnVS9HTzI4MmNINk11a01MK3N3SHNh?=
 =?utf-8?B?d3M5YWZJbHpIN1pveVdzazUyaFVPOGhjTDZyZEptNmtrait5c2ZqbXpuZzIz?=
 =?utf-8?Q?Fvccu+anAeN6JHdg=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 93d4ed81-119e-43c6-664d-08da38a40b3c
X-MS-Exchange-CrossTenant-AuthSource: DM6PR11MB3180.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 May 2022 07:57:24.5645
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Iz16qfp2K9qeqlCjVBNPyMosyXcbX0AbwWFDOnnqwxsg1UQShRiMbassnKLxSYoim/Spd3fJsCH4wrXYOzIjGA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR11MB6534
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
	DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,NICE_REPLY_A,RDNS_NONE,SPF_HELO_NONE,
	T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 18.05.2022 08:58, Hangyu Hua wrote:
> The next call to sii8620_burst_get_tx_buf will result in off-by-one
> When ctx->burst.tx_count + size == ARRAY_SIZE(ctx->burst.tx_buf). The same
> thing happens in sii8620_burst_get_rx_buf.
>
> This patch also change tx_count and tx_buf to rx_count and rx_buf in
> sii8620_burst_get_rx_buf. It is unreasonable to check tx_buf's size and
> use rx_buf.
>
> Fixes: e19e9c692f81 ("drm/bridge/sii8620: add support for burst eMSC transmissions")
> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>

Regards
Andrzej
> ---
>   drivers/gpu/drm/bridge/sil-sii8620.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c
> index ec7745c31da0..ab0bce4a988c 100644
> --- a/drivers/gpu/drm/bridge/sil-sii8620.c
> +++ b/drivers/gpu/drm/bridge/sil-sii8620.c
> @@ -605,7 +605,7 @@ static void *sii8620_burst_get_tx_buf(struct sii8620 *ctx, int len)
>   	u8 *buf = &ctx->burst.tx_buf[ctx->burst.tx_count];
>   	int size = len + 2;
>   
> -	if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) {
> +	if (ctx->burst.tx_count + size >= ARRAY_SIZE(ctx->burst.tx_buf)) {
>   		dev_err(ctx->dev, "TX-BLK buffer exhausted\n");
>   		ctx->error = -EINVAL;
>   		return NULL;
> @@ -622,7 +622,7 @@ static u8 *sii8620_burst_get_rx_buf(struct sii8620 *ctx, int len)
>   	u8 *buf = &ctx->burst.rx_buf[ctx->burst.rx_count];
>   	int size = len + 1;
>   
> -	if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) {
> +	if (ctx->burst.rx_count + size >= ARRAY_SIZE(ctx->burst.rx_buf)) {
>   		dev_err(ctx->dev, "RX-BLK buffer exhausted\n");
>   		ctx->error = -EINVAL;
>   		return NULL;