Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
MIME-Version: 1.0
References: <202205271546.oV14N2r8-lkp@intel.com>
In-Reply-To: <202205271546.oV14N2r8-lkp@intel.com>
From:   Alex Deucher <alexdeucher@gmail.com>
Date:   Wed, 1 Jun 2022 14:43:57 -0400
Message-ID: <CADnq5_NOkqRsoqELkLayNU+xArXd-4RO=_banvJpXHtSW4-YdA@mail.gmail.com>
Subject: Re: [kbuild] drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1433
 amdgpu_discovery_get_vcn_info() error: buffer overflow 'adev->vcn.vcn_codec_disable_mask'
 2 <= 3
To:     Dan Carpenter <dan.carpenter@oracle.com>
Cc:     kbuild@lists.01.org, Alex Deucher <alexander.deucher@amd.com>,
        kbuild-all@lists.01.org, kernel test robot <lkp@intel.com>,
        amd-gfx list <amd-gfx@lists.freedesktop.org>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Fri, May 27, 2022 at 3:46 AM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> [ kbuild bot sent this warning on May 4 but I never heard back and it's
>   May 27 now so sending a duplicate warning is probably for the best. -dan]
>
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  master
> head:   7e284070abe53d448517b80493863595af4ab5f0
> commit: 622469c87fc3e6c90a980be3e2287d82bd55c977 drm/amdgpu/discovery: add a function to parse the vcn info table
> config: arc-randconfig-m031-20220524 (https://download.01.org/0day-ci/archive/20220527/202205271546.oV14N2r8-lkp@intel.com/config )
> compiler: arceb-elf-gcc (GCC) 11.3.0
>
> If you fix the issue, kindly add following tag where applicable
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> smatch warnings:
> drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1433 amdgpu_discovery_get_vcn_info() error: buffer overflow 'adev->vcn.vcn_codec_disable_mask' 2 <= 3
>
> vim +1433 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
>
> 622469c87fc3e6 Alex Deucher 2022-03-30  1403  int amdgpu_discovery_get_vcn_info(struct amdgpu_device *adev)
> 622469c87fc3e6 Alex Deucher 2022-03-30  1404  {
> 622469c87fc3e6 Alex Deucher 2022-03-30  1405    struct binary_header *bhdr;
> 622469c87fc3e6 Alex Deucher 2022-03-30  1406    union vcn_info *vcn_info;
> 622469c87fc3e6 Alex Deucher 2022-03-30  1407    u16 offset;
> 622469c87fc3e6 Alex Deucher 2022-03-30  1408    int v;
> 622469c87fc3e6 Alex Deucher 2022-03-30  1409
> 622469c87fc3e6 Alex Deucher 2022-03-30  1410    if (!adev->mman.discovery_bin) {
> 622469c87fc3e6 Alex Deucher 2022-03-30  1411            DRM_ERROR("ip discovery uninitialized\n");
> 622469c87fc3e6 Alex Deucher 2022-03-30  1412            return -EINVAL;
> 622469c87fc3e6 Alex Deucher 2022-03-30  1413    }
> 622469c87fc3e6 Alex Deucher 2022-03-30  1414
> 622469c87fc3e6 Alex Deucher 2022-03-30  1415    if (adev->vcn.num_vcn_inst > VCN_INFO_TABLE_MAX_NUM_INSTANCES) {
>
> Capped to 4
>
> 622469c87fc3e6 Alex Deucher 2022-03-30  1416            dev_err(adev->dev, "invalid vcn instances\n");
> 622469c87fc3e6 Alex Deucher 2022-03-30  1417            return -EINVAL;
> 622469c87fc3e6 Alex Deucher 2022-03-30  1418    }
> 622469c87fc3e6 Alex Deucher 2022-03-30  1419
> 622469c87fc3e6 Alex Deucher 2022-03-30  1420    bhdr = (struct binary_header *)adev->mman.discovery_bin;
> 622469c87fc3e6 Alex Deucher 2022-03-30  1421    offset = le16_to_cpu(bhdr->table_list[VCN_INFO].offset);
> 622469c87fc3e6 Alex Deucher 2022-03-30  1422
> 622469c87fc3e6 Alex Deucher 2022-03-30  1423    if (!offset) {
> 622469c87fc3e6 Alex Deucher 2022-03-30  1424            dev_err(adev->dev, "invalid vcn table offset\n");
> 622469c87fc3e6 Alex Deucher 2022-03-30  1425            return -EINVAL;
> 622469c87fc3e6 Alex Deucher 2022-03-30  1426    }
> 622469c87fc3e6 Alex Deucher 2022-03-30  1427
> 622469c87fc3e6 Alex Deucher 2022-03-30  1428    vcn_info = (union vcn_info *)(adev->mman.discovery_bin + offset);
> 622469c87fc3e6 Alex Deucher 2022-03-30  1429
> 622469c87fc3e6 Alex Deucher 2022-03-30  1430    switch (le16_to_cpu(vcn_info->v1.header.version_major)) {
> 622469c87fc3e6 Alex Deucher 2022-03-30  1431    case 1:
> 622469c87fc3e6 Alex Deucher 2022-03-30  1432            for (v = 0; v < adev->vcn.num_vcn_inst; v++) {
> 622469c87fc3e6 Alex Deucher 2022-03-30 @1433                    adev->vcn.vcn_codec_disable_mask[v] =
>
> But this array doesn't have 4 elements

Correct, but num_vcn_inst can't be larger than
AMDGPU_MAX_VCN_INSTANCES (2) at the moment thanks to:
https://patchwork.freedesktop.org/patch/486289/

Alex

>
> 622469c87fc3e6 Alex Deucher 2022-03-30  1434                            le32_to_cpu(vcn_info->v1.instance_info[v].fuse_data.all_bits);
> 622469c87fc3e6 Alex Deucher 2022-03-30  1435            }
> 622469c87fc3e6 Alex Deucher 2022-03-30  1436            break;
> 622469c87fc3e6 Alex Deucher 2022-03-30  1437    default:
> 622469c87fc3e6 Alex Deucher 2022-03-30  1438            dev_err(adev->dev,
> 622469c87fc3e6 Alex Deucher 2022-03-30  1439                    "Unhandled VCN info table %d.%d\n",
> 622469c87fc3e6 Alex Deucher 2022-03-30  1440                    le16_to_cpu(vcn_info->v1.header.version_major),
> 622469c87fc3e6 Alex Deucher 2022-03-30  1441                    le16_to_cpu(vcn_info->v1.header.version_minor));
> 622469c87fc3e6 Alex Deucher 2022-03-30  1442            return -EINVAL;
> 622469c87fc3e6 Alex Deucher 2022-03-30  1443    }
> 622469c87fc3e6 Alex Deucher 2022-03-30  1444    return 0;
> f39f5bb1c9d68d Xiaojie Yuan 2019-06-20  1445  }
>
> --
> 0-DAY CI Kernel Test Service
> https://01.org/lkp
> _______________________________________________
> kbuild mailing list -- kbuild@lists.01.org
> To unsubscribe send an email to kbuild-leave@lists.01.org
>