1. Patchew
  2. linux
  3. View series

[PATCH] drm/amdgpu: fix i2s_pdata out of bound array access

Vijendar Mukunda posted 1 patch 3 years, 8 months ago 
drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 8 --------
1 file changed, 8 deletions(-)
[PATCH] drm/amdgpu: fix i2s_pdata out of bound array access
Posted by Vijendar Mukunda 3 years, 8 months ago 
Fixed following Smatch static checker warning:

    drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:393 acp_hw_init()
    error: buffer overflow 'i2s_pdata' 3 <= 3
    drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:396 acp_hw_init()
    error: buffer overflow 'i2s_pdata' 3 <= 3

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
index bcc7ee02e0fc..6d72355ac492 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
@@ -390,14 +390,6 @@ static int acp_hw_init(void *handle)
 		i2s_pdata[2].i2s_reg_comp1 = ACP_BT_COMP1_REG_OFFSET;
 		i2s_pdata[2].i2s_reg_comp2 = ACP_BT_COMP2_REG_OFFSET;
 
-		i2s_pdata[3].quirks = DW_I2S_QUIRK_COMP_REG_OFFSET;
-		switch (adev->asic_type) {
-		case CHIP_STONEY:
-			i2s_pdata[3].quirks |= DW_I2S_QUIRK_16BIT_IDX_OVERRIDE;
-			break;
-		default:
-			break;
-		}
 		adev->acp.acp_res[0].name = "acp2x_dma";
 		adev->acp.acp_res[0].flags = IORESOURCE_MEM;
 		adev->acp.acp_res[0].start = acp_base;
-- 
2.25.1
Re: [PATCH] drm/amdgpu: fix i2s_pdata out of bound array access
Posted by Alex Deucher 3 years, 8 months ago 
On Wed, Jul 27, 2022 at 10:42 AM Vijendar Mukunda
<Vijendar.Mukunda@amd.com> wrote:
>
> Fixed following Smatch static checker warning:
>
>     drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:393 acp_hw_init()
>     error: buffer overflow 'i2s_pdata' 3 <= 3
>     drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:396 acp_hw_init()
>     error: buffer overflow 'i2s_pdata' 3 <= 3
>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
> ---
>  drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 8 --------
>  1 file changed, 8 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> index bcc7ee02e0fc..6d72355ac492 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> @@ -390,14 +390,6 @@ static int acp_hw_init(void *handle)
>                 i2s_pdata[2].i2s_reg_comp1 = ACP_BT_COMP1_REG_OFFSET;
>                 i2s_pdata[2].i2s_reg_comp2 = ACP_BT_COMP2_REG_OFFSET;
>
> -               i2s_pdata[3].quirks = DW_I2S_QUIRK_COMP_REG_OFFSET;
> -               switch (adev->asic_type) {
> -               case CHIP_STONEY:
> -                       i2s_pdata[3].quirks |= DW_I2S_QUIRK_16BIT_IDX_OVERRIDE;
> -                       break;
> -               default:
> -                       break;
> -               }

Is this actually not used or should we just increase the allocation size?

Alex

>                 adev->acp.acp_res[0].name = "acp2x_dma";
>                 adev->acp.acp_res[0].flags = IORESOURCE_MEM;
>                 adev->acp.acp_res[0].start = acp_base;
> --
> 2.25.1
>
Re: [PATCH] drm/amdgpu: fix i2s_pdata out of bound array access
Posted by Mukunda,Vijendar 3 years, 8 months ago 
On 7/27/22 8:25 PM, Alex Deucher wrote:
> On Wed, Jul 27, 2022 at 10:42 AM Vijendar Mukunda
> <Vijendar.Mukunda@amd.com> wrote:
>>
>> Fixed following Smatch static checker warning:
>>
>>     drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:393 acp_hw_init()
>>     error: buffer overflow 'i2s_pdata' 3 <= 3
>>     drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:396 acp_hw_init()
>>     error: buffer overflow 'i2s_pdata' 3 <= 3
>>
>> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>> Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
>> ---
>>  drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 8 --------
>>  1 file changed, 8 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
>> index bcc7ee02e0fc..6d72355ac492 100644
>> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
>> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
>> @@ -390,14 +390,6 @@ static int acp_hw_init(void *handle)
>>                 i2s_pdata[2].i2s_reg_comp1 = ACP_BT_COMP1_REG_OFFSET;
>>                 i2s_pdata[2].i2s_reg_comp2 = ACP_BT_COMP2_REG_OFFSET;
>>
>> -               i2s_pdata[3].quirks = DW_I2S_QUIRK_COMP_REG_OFFSET;
>> -               switch (adev->asic_type) {
>> -               case CHIP_STONEY:
>> -                       i2s_pdata[3].quirks |= DW_I2S_QUIRK_16BIT_IDX_OVERRIDE;
>> -                       break;
>> -               default:
>> -                       break;
>> -               }
> 
> Is this actually not used or should we just increase the allocation size?
> 
> Alex
it's my bad. i2s_pdata array size is 3. when we recently included code
changes for JD platform , this piece of code was added mistakenly for
Stoney platform switch case.

--
Vijendar

> 
>>                 adev->acp.acp_res[0].name = "acp2x_dma";
>>                 adev->acp.acp_res[0].flags = IORESOURCE_MEM;
>>                 adev->acp.acp_res[0].start = acp_base;
>> --
>> 2.25.1
>>
Re: [PATCH] drm/amdgpu: fix i2s_pdata out of bound array access
Posted by Alex Deucher 3 years, 8 months ago 
On Wed, Jul 27, 2022 at 11:16 AM Mukunda,Vijendar
<vijendar.mukunda@amd.com> wrote:
>
> On 7/27/22 8:25 PM, Alex Deucher wrote:
> > On Wed, Jul 27, 2022 at 10:42 AM Vijendar Mukunda
> > <Vijendar.Mukunda@amd.com> wrote:
> >>
> >> Fixed following Smatch static checker warning:
> >>
> >>     drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:393 acp_hw_init()
> >>     error: buffer overflow 'i2s_pdata' 3 <= 3
> >>     drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c:396 acp_hw_init()
> >>     error: buffer overflow 'i2s_pdata' 3 <= 3
> >>
> >> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> >> Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
> >> ---
> >>  drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 8 --------
> >>  1 file changed, 8 deletions(-)
> >>
> >> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> >> index bcc7ee02e0fc..6d72355ac492 100644
> >> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> >> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
> >> @@ -390,14 +390,6 @@ static int acp_hw_init(void *handle)
> >>                 i2s_pdata[2].i2s_reg_comp1 = ACP_BT_COMP1_REG_OFFSET;
> >>                 i2s_pdata[2].i2s_reg_comp2 = ACP_BT_COMP2_REG_OFFSET;
> >>
> >> -               i2s_pdata[3].quirks = DW_I2S_QUIRK_COMP_REG_OFFSET;
> >> -               switch (adev->asic_type) {
> >> -               case CHIP_STONEY:
> >> -                       i2s_pdata[3].quirks |= DW_I2S_QUIRK_16BIT_IDX_OVERRIDE;
> >> -                       break;
> >> -               default:
> >> -                       break;
> >> -               }
> >
> > Is this actually not used or should we just increase the allocation size?
> >
> > Alex
> it's my bad. i2s_pdata array size is 3. when we recently included code
> changes for JD platform , this piece of code was added mistakenly for
> Stoney platform switch case.

Thanks.  Patch is:
Acked-by: Alex Deucher <alexander.deucher@amd.com>

>
> --
> Vijendar
>
> >
> >>                 adev->acp.acp_res[0].name = "acp2x_dma";
> >>                 adev->acp.acp_res[0].flags = IORESOURCE_MEM;
> >>                 adev->acp.acp_res[0].start = acp_base;
> >> --
> >> 2.25.1
> >>
>

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.