Re: [bug report] soundwire: qcom: Check device status before reading devid

Hi Dan,

On 08/07/2022 09:08, Dan Carpenter wrote:

Hello Srinivas Kandagatla,

The patch aa1262ca6695: "soundwire: qcom: Check device status before reading devid" from Jul 6, 2022, leads to the following Smatch static checker warning:

drivers/soundwire/qcom.c:484 qcom_swrm_enumerate() error: buffer overflow 'ctrl->status' 11 <= 11

drivers/soundwire/qcom.c 471 static int qcom_swrm_enumerate(struct sdw_bus *bus) 472 { 473 struct qcom_swrm_ctrl *ctrl = to_qcom_sdw(bus); 474 struct sdw_slave *slave, *_s; 475 struct sdw_slave_id id; 476 u32 val1, val2; 477 bool found; 478 u64 addr; 479 int i; 480 char *buf1 = (char *)&val1, *buf2 = (char *)&val2; 481 482 for (i = 1; i <= SDW_MAX_DEVICES; i++) { ^^^^^ This a loop that starts from 1 instead of 0. I looked at the surrounding context and it seems like it should be a normal loop that starts at 0 and goes to < SDW_MAX_DEVICES.

In SoundWire world device id 0 is special one and used for enumerating the SoundWire devices.

Only addresses from 1-11 are valid devids that can be assigned to devices by the host/controller.

This part of the code is reading the devids assigned by the hw auto-enumeration, So the loop start from 1 is correct here.

(Or possibly the other loops are buggy as well).

Atleast this code is fine, but I see other places where are starting from 0 which could be fixed but the SoundWire core will ignore the status for devid 0.

--srini

 483                 /* do not continue if the status is Not Present  */

--> 484 if (!ctrl->status[i])

So this is off by one and reads one element beyond the end of the loop.

 485                         continue;
 486
 487                 /*SCP_Devid5 - Devid 4*/
 488                 ctrl->reg_read(ctrl, SWRM_ENUMERATOR_SLAVE_DEV_ID_1(i), &val1);
 489
 490                 /*SCP_Devid3 - DevId 2 Devid 1 Devid 0*/
 491                 ctrl->reg_read(ctrl, SWRM_ENUMERATOR_SLAVE_DEV_ID_2(i), &val2);
 492
 493                 if (!val1 && !val2)
 494                         break;
 495
 496                 addr = buf2[1] | (buf2[0] << 8) | (buf1[3] << 16) |
 497                         ((u64)buf1[2] << 24) | ((u64)buf1[1] << 32) |
 498                         ((u64)buf1[0] << 40);
 499
 500                 sdw_extract_slave_id(bus, addr, &id);
 501                 found = false;
 502                 /* Now compare with entries */
 503                 list_for_each_entry_safe(slave, _s, &bus->slaves, node) {
 504                         if (sdw_compare_devid(slave, id) == 0) {
 505                                 qcom_swrm_set_slave_dev_num(bus, slave, i);
 506                                 found = true;
 507                                 break;
 508                         }
 509                 }
 510
 511                 if (!found) {
 512                         qcom_swrm_set_slave_dev_num(bus, NULL, i);
 513                         sdw_slave_add(bus, &id, NULL);
 514                 }
 515         }
 516
 517         complete(&ctrl->enumeration);
 518         return 0;
 519 }

regards, dan carpenter