Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
Date:   Fri, 27 May 2022 10:46:22 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     kbuild@lists.01.org, Alex Deucher <alexander.deucher@amd.com>
Cc:     lkp@intel.com, kbuild-all@lists.01.org,
        amd-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: [kbuild] drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1433
 amdgpu_discovery_get_vcn_info() error: buffer overflow
 'adev->vcn.vcn_codec_disable_mask' 2 <= 3
Message-ID: <202205271546.oV14N2r8-lkp@intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Message-ID-Hash: RSXNMVBDZWM77U6CNZCI6SNQ7TXGEQRJ
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?PjynHt5/E4ta/enGd2ejW/QhkUMSFMV/fmh2HVFB7nIESpVtW7gsxwt2I9n3?=
 =?us-ascii?Q?pv5IvaGN61rr/EjmXk7JLiWRFkc3H2Jgfq0WmofxBu6tB404u2tG4jR17kKR?=
 =?us-ascii?Q?wkSXxUJnVy3WPWqBZNL5rwdgxea8NEaaYyzw+zQX+CgMyW7CeoMv++B6YI0U?=
 =?us-ascii?Q?/ywbbckM4mObUsoqfEcbq9q30CSlg9RGKXX6e5FSGaUu+NQoBjUNLzfQPVC6?=
 =?us-ascii?Q?36hvKS/xEZclahlSP3hT0RaR5B/vX12ohqxxC2/2om6eJGvrl0//S1R3Abyj?=
 =?us-ascii?Q?eF+bBBulyFjKxMz8ektY7nY+VxmuFdINZMU4xXoZbIaGkIxNoEf0CoCdqh/d?=
 =?us-ascii?Q?RKBwZ/75oMb8h8NXumy3B01vMfTSN+U48KTqzHC4/x3xHbzyTAP5y0z5sc36?=
 =?us-ascii?Q?V0YPo0qkHdrEs5/dF4tesXMq6E8txBx6FI7s0gD+qUZxXM7k5BfeIru7WdAH?=
 =?us-ascii?Q?Y4L9aq6s/NVBwLe8W1ZZrDrayp4wugfRG4pnMIRvFgUngRmJiFqjbTGvwt6X?=
 =?us-ascii?Q?gSJWL1cDO3LjsF8mMciPfizpl5qcKCfjnQZXZh67xsoQ8iflyV5B1tZKY0dP?=
 =?us-ascii?Q?htZgK+/Tdv1HCaf+lovDvjBYh7sq29c38wHnwFdARjIpBW76iX43u+fkYLHp?=
 =?us-ascii?Q?wmLRyoWQSoaOR6LbuzFfGwbsNCy0ZR/FQdOpLE1ZriobgU+zQ0vIruYTHuq0?=
 =?us-ascii?Q?ugllKv4IR4Pb+Exumue8MIrLlljCKZ2Q8xAx1OavwDjWd1QMNYiWV/hbLXaX?=
 =?us-ascii?Q?C4ulzgutN74kpD0dvdcIxBNlD7+U8AM+NC0cRit5r/FdllzySLoKZxrVt2rg?=
 =?us-ascii?Q?prEjWwicxigdhucR6cpeGr7IixFrUZFKfvCGdOdHpOzrrj7lhr8L9yHY9ryX?=
 =?us-ascii?Q?oGFGLbsPPGyvoewJrXmRwsoPm2lUiIJ2HEgpjaha5Tfy3c+g2oC3HJ2yiFkd?=
 =?us-ascii?Q?0Duj1eTYF5AjOjWSqHq2v+EAIe9+S1MwnFQxxDlQrrGwvFxCHrTX6xwkSl7R?=
 =?us-ascii?Q?XxbPCzPYhoapqnuF0d2zVUDR6lJrAjMaeFxfY68snC7iuqx7Ib0KUHnujMAC?=
 =?us-ascii?Q?jPihW9iZeGL+4lW5scBFqZJN90fD+nYtaytz5GRp+gaLhJu6tt7ERPvM3xIP?=
 =?us-ascii?Q?OsgybYfy664pe+gCMW+j4koDY+IVsclFXB0Yss3vC6k9t6RQEmklrPifNwxP?=
 =?us-ascii?Q?ZUven7s3gNmdyTmrQUv+Il6TTIaiFW5y1UblwwmbRDqdTEpFHACwjfGVrslz?=
 =?us-ascii?Q?4eWa8+wPsyly1wvHj66FRaFxDpBZ1SOCdShZnFYYxBss1nIJ7YGXsAMXh5BS?=
 =?us-ascii?Q?Hnzx+b4dtUW07Et5d1TFBOJlOCZROD2u+qUid2vbO1JZs4dia/Caj+GKTw0k?=
 =?us-ascii?Q?PEnkqIBjnxTxm0lx0SWprAhGdSHrxXCzKpifFUcWLu7g6LsKMnATdnw4I1EP?=
 =?us-ascii?Q?M4fSt/2Cc6rPBGE1xhmnPrO1YNoUmCMMAuRTMSo+/rncR8WNQXnliBJoz8Xl?=
 =?us-ascii?Q?/w59GEe77cq4+fbpllSWKcgY4P/w8QMy0oQt5nzqGeoxoJHwT0yOQdP3EdhN?=
 =?us-ascii?Q?TZdcKj2MKTIuUhYYiPF1K2nk1wJvkoV5LHVR/lLCBLyYH2m8c5Ex4SYXqQ1A?=
 =?us-ascii?Q?SUBprVUuLZjwNNueGFkfK6zBvgROfDl0k1HZLA9seHhGTAzfSzS+W3XxfFVS?=
 =?us-ascii?Q?xGKVVefwyOGKis6dky4kuuzNcrRDb60zM/R1iEWLOgYXd/FXC9GpZennYMWy?=
 =?us-ascii?Q?GHdOfM2YfMxXk9tzoufxI+fIkDjKStE=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5be00a38-bb67-4077-0814-08da3fb506ac
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 May 2022 07:46:36.1008
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: N3wkoM4Fs2wGiM1XgVD6i+mJwMQLCrzfulWV12RI2fcpEg+NjCJ1z86hl5vkgkP9sAHiXNN/x1fyOj5Cg4sQKgOTCJ9yki7FDy4K+v4x9Fk=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR10MB1963
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.486,18.0.874
 definitions=2022-05-27_02:2022-05-25,2022-05-27 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 suspectscore=0
 malwarescore=0 phishscore=0 mlxlogscore=999 adultscore=0 mlxscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2204290000 definitions=main-2205270038
X-Proofpoint-GUID: g0BCByAmCg75aCIdroOoq0PqklTSwAqM
X-Proofpoint-ORIG-GUID: g0BCByAmCg75aCIdroOoq0PqklTSwAqM
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

[ kbuild bot sent this warning on May 4 but I never heard back and it's
  May 27 now so sending a duplicate warning is probably for the best. -dan]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  master
head:   7e284070abe53d448517b80493863595af4ab5f0
commit: 622469c87fc3e6c90a980be3e2287d82bd55c977 drm/amdgpu/discovery: add a function to parse the vcn info table
config: arc-randconfig-m031-20220524 (https://download.01.org/0day-ci/archive/20220527/202205271546.oV14N2r8-lkp@intel.com/config )
compiler: arceb-elf-gcc (GCC) 11.3.0

If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

smatch warnings:
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1433 amdgpu_discovery_get_vcn_info() error: buffer overflow 'adev->vcn.vcn_codec_disable_mask' 2 <= 3

vim +1433 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c

622469c87fc3e6 Alex Deucher 2022-03-30  1403  int amdgpu_discovery_get_vcn_info(struct amdgpu_device *adev)
622469c87fc3e6 Alex Deucher 2022-03-30  1404  {
622469c87fc3e6 Alex Deucher 2022-03-30  1405  	struct binary_header *bhdr;
622469c87fc3e6 Alex Deucher 2022-03-30  1406  	union vcn_info *vcn_info;
622469c87fc3e6 Alex Deucher 2022-03-30  1407  	u16 offset;
622469c87fc3e6 Alex Deucher 2022-03-30  1408  	int v;
622469c87fc3e6 Alex Deucher 2022-03-30  1409  
622469c87fc3e6 Alex Deucher 2022-03-30  1410  	if (!adev->mman.discovery_bin) {
622469c87fc3e6 Alex Deucher 2022-03-30  1411  		DRM_ERROR("ip discovery uninitialized\n");
622469c87fc3e6 Alex Deucher 2022-03-30  1412  		return -EINVAL;
622469c87fc3e6 Alex Deucher 2022-03-30  1413  	}
622469c87fc3e6 Alex Deucher 2022-03-30  1414  
622469c87fc3e6 Alex Deucher 2022-03-30  1415  	if (adev->vcn.num_vcn_inst > VCN_INFO_TABLE_MAX_NUM_INSTANCES) {

Capped to 4

622469c87fc3e6 Alex Deucher 2022-03-30  1416  		dev_err(adev->dev, "invalid vcn instances\n");
622469c87fc3e6 Alex Deucher 2022-03-30  1417  		return -EINVAL;
622469c87fc3e6 Alex Deucher 2022-03-30  1418  	}
622469c87fc3e6 Alex Deucher 2022-03-30  1419  
622469c87fc3e6 Alex Deucher 2022-03-30  1420  	bhdr = (struct binary_header *)adev->mman.discovery_bin;
622469c87fc3e6 Alex Deucher 2022-03-30  1421  	offset = le16_to_cpu(bhdr->table_list[VCN_INFO].offset);
622469c87fc3e6 Alex Deucher 2022-03-30  1422  
622469c87fc3e6 Alex Deucher 2022-03-30  1423  	if (!offset) {
622469c87fc3e6 Alex Deucher 2022-03-30  1424  		dev_err(adev->dev, "invalid vcn table offset\n");
622469c87fc3e6 Alex Deucher 2022-03-30  1425  		return -EINVAL;
622469c87fc3e6 Alex Deucher 2022-03-30  1426  	}
622469c87fc3e6 Alex Deucher 2022-03-30  1427  
622469c87fc3e6 Alex Deucher 2022-03-30  1428  	vcn_info = (union vcn_info *)(adev->mman.discovery_bin + offset);
622469c87fc3e6 Alex Deucher 2022-03-30  1429  
622469c87fc3e6 Alex Deucher 2022-03-30  1430  	switch (le16_to_cpu(vcn_info->v1.header.version_major)) {
622469c87fc3e6 Alex Deucher 2022-03-30  1431  	case 1:
622469c87fc3e6 Alex Deucher 2022-03-30  1432  		for (v = 0; v < adev->vcn.num_vcn_inst; v++) {
622469c87fc3e6 Alex Deucher 2022-03-30 @1433  			adev->vcn.vcn_codec_disable_mask[v] =

But this array doesn't have 4 elements

622469c87fc3e6 Alex Deucher 2022-03-30  1434  				le32_to_cpu(vcn_info->v1.instance_info[v].fuse_data.all_bits);
622469c87fc3e6 Alex Deucher 2022-03-30  1435  		}
622469c87fc3e6 Alex Deucher 2022-03-30  1436  		break;
622469c87fc3e6 Alex Deucher 2022-03-30  1437  	default:
622469c87fc3e6 Alex Deucher 2022-03-30  1438  		dev_err(adev->dev,
622469c87fc3e6 Alex Deucher 2022-03-30  1439  			"Unhandled VCN info table %d.%d\n",
622469c87fc3e6 Alex Deucher 2022-03-30  1440  			le16_to_cpu(vcn_info->v1.header.version_major),
622469c87fc3e6 Alex Deucher 2022-03-30  1441  			le16_to_cpu(vcn_info->v1.header.version_minor));
622469c87fc3e6 Alex Deucher 2022-03-30  1442  		return -EINVAL;
622469c87fc3e6 Alex Deucher 2022-03-30  1443  	}
622469c87fc3e6 Alex Deucher 2022-03-30  1444  	return 0;
f39f5bb1c9d68d Xiaojie Yuan 2019-06-20  1445  }

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp 
_______________________________________________
kbuild mailing list -- kbuild@lists.01.org
To unsubscribe send an email to kbuild-leave@lists.01.org