Revision 58fca355ad37dcb5f785d9095db5f748b79c5dc2 authored by Srinivasan Shanmugam on 07 February 2024, 04:50:57 UTC, committed by Alex Deucher on 07 February 2024, 23:30:04 UTC
'stream_enc_regs' array is an array of dcn10_stream_enc_registers
structures. The array is initialized with four elements, corresponding
to the four calls to stream_enc_regs() in the array initializer. This
means that valid indices for this array are 0, 1, 2, and 3.

The error message 'stream_enc_regs' 4 <= 5 below, is indicating that
there is an attempt to access this array with an index of 5, which is
out of bounds. This could lead to undefined behavior

Here, eng_id is used as an index to access the stream_enc_regs array. If
eng_id is 5, this would result in an out-of-bounds access on the
stream_enc_regs array.

Thus fixing Buffer overflow error in dcn301_stream_encoder_create
reported by Smatch:
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn301/dcn301_resource.c:1011 dcn301_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5

Fixes: 3a83e4e64bb1 ("drm/amd/display: Add dcn3.01 support to DC (v2)")
Cc: Roman Li <Roman.Li@amd.com>
Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Roman Li <roman.li@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
1 parent e63e35f
Raw File
dmapool_test.c
#include <linux/device.h>
#include <linux/dma-map-ops.h>
#include <linux/dma-mapping.h>
#include <linux/dmapool.h>
#include <linux/kernel.h>
#include <linux/ktime.h>
#include <linux/module.h>

#define NR_TESTS (100)

struct dma_pool_pair {
	dma_addr_t dma;
	void *v;
};

struct dmapool_parms {
	size_t size;
	size_t align;
	size_t boundary;
};

static const struct dmapool_parms pool_parms[] = {
	{ .size = 16, .align = 16, .boundary = 0 },
	{ .size = 64, .align = 64, .boundary = 0 },
	{ .size = 256, .align = 256, .boundary = 0 },
	{ .size = 1024, .align = 1024, .boundary = 0 },
	{ .size = 4096, .align = 4096, .boundary = 0 },
	{ .size = 68, .align = 32, .boundary = 4096 },
};

static struct dma_pool *pool;
static struct device test_dev;
static u64 dma_mask;

static inline int nr_blocks(int size)
{
	return clamp_t(int, (PAGE_SIZE / size) * 512, 1024, 8192);
}

static int dmapool_test_alloc(struct dma_pool_pair *p, int blocks)
{
	int i;

	for (i = 0; i < blocks; i++) {
		p[i].v = dma_pool_alloc(pool, GFP_KERNEL,
					&p[i].dma);
		if (!p[i].v)
			goto pool_fail;
	}

	for (i = 0; i < blocks; i++)
		dma_pool_free(pool, p[i].v, p[i].dma);

	return 0;

pool_fail:
	for (--i; i >= 0; i--)
		dma_pool_free(pool, p[i].v, p[i].dma);
	return -ENOMEM;
}

static int dmapool_test_block(const struct dmapool_parms *parms)
{
	int blocks = nr_blocks(parms->size);
	ktime_t start_time, end_time;
	struct dma_pool_pair *p;
	int i, ret;

	p = kcalloc(blocks, sizeof(*p), GFP_KERNEL);
	if (!p)
		return -ENOMEM;

	pool = dma_pool_create("test pool", &test_dev, parms->size,
			       parms->align, parms->boundary);
	if (!pool) {
		ret = -ENOMEM;
		goto free_pairs;
	}

	start_time = ktime_get();
	for (i = 0; i < NR_TESTS; i++) {
		ret = dmapool_test_alloc(p, blocks);
		if (ret)
			goto free_pool;
		if (need_resched())
			cond_resched();
	}
	end_time = ktime_get();

	printk("dmapool test: size:%-4zu align:%-4zu blocks:%-4d time:%llu\n",
		parms->size, parms->align, blocks,
		ktime_us_delta(end_time, start_time));

free_pool:
	dma_pool_destroy(pool);
free_pairs:
	kfree(p);
	return ret;
}

static void dmapool_test_release(struct device *dev)
{
}

static int dmapool_checks(void)
{
	int i, ret;

	ret = dev_set_name(&test_dev, "dmapool-test");
	if (ret)
		return ret;

	ret = device_register(&test_dev);
	if (ret) {
		printk("%s: register failed:%d\n", __func__, ret);
		goto put_device;
	}

	test_dev.release = dmapool_test_release;
	set_dma_ops(&test_dev, NULL);
	test_dev.dma_mask = &dma_mask;
	ret = dma_set_mask_and_coherent(&test_dev, DMA_BIT_MASK(64));
	if (ret) {
		printk("%s: mask failed:%d\n", __func__, ret);
		goto del_device;
	}

	for (i = 0; i < ARRAY_SIZE(pool_parms); i++) {
		ret = dmapool_test_block(&pool_parms[i]);
		if (ret)
			break;
	}

del_device:
	device_del(&test_dev);
put_device:
	put_device(&test_dev);
	return ret;
}

static void dmapool_exit(void)
{
}

module_init(dmapool_checks);
module_exit(dmapool_exit);
MODULE_LICENSE("GPL");
back to top