drm: kasan failed for slab-out-of-bounds [1/1]

PD#SWPL-151540

Problem:
kasan failed
cat/echo sysfs osd node crash in s5
cat fbdump return zero size file in s5

Solution:
reset BLOCK_ID_MAX with 32
sysfs node should according to vpu block by index
set correct plane index

Verify:
s5, t5m

Test:
DRM-OSD-17

Change-Id: I02094c9044b172af46ab9b5bd5688a12f18ce96a
Signed-off-by: mingyang.he <mingyang.he@amlogic.com>

drivers/drm/meson_debugfs.c

@@ -114,7 +114,7 @@ static int osd_fbdump_open(struct inode *inode, struct file *filp)
 	pipeline = priv->pipeline;
 	mvps = priv_to_pipeline_state(pipeline->obj.state);
 
-	index = plane->index;
+	index = amp->plane_index;
 	info = &mvps->plane_info[index];
 
 	if (!info->enable) {
@@ -129,6 +129,7 @@ static int osd_fbdump_open(struct inode *inode, struct file *filp)
 	amp->bflg = bflg;
 	amp->vir_addr = vir_addr;
 	amp->dump_size = fb_size;
+	DRM_INFO("%s, %px, %u\n", __func__, vir_addr, fb_size);
 
 	return 0;
 }

drivers/drm/meson_sysfs.c

@@ -1425,10 +1425,16 @@ int meson_drm_sysfs_register(struct drm_device *drm_dev)
 	rc = sysfs_create_bin_file(&dev->kobj, &state_attr);
 	rc = sysfs_create_bin_file(&dev->kobj, &reg_dump_attr);
 
-	for (i = 0; i < priv->pipeline->num_osds; i++)
+	for (i = 0; i < MESON_MAX_OSDS; i++) {
+		if (!priv->pipeline->osds[i])
+			continue;
 		rc = sysfs_create_group(&dev->kobj, &osd_attr_group[i]);
-	for (i = 0; i < priv->pipeline->num_postblend; i++)
+	}
+	for (i = 0; i < MESON_MAX_POSTBLEND; i++) {
+		if (!priv->pipeline->postblends[i])
+			continue;
 		rc = sysfs_create_group(&dev->kobj, &crtc_attr_group[i]);
+	}
 
 	return rc;
 }
@@ -1443,9 +1449,15 @@ void meson_drm_sysfs_unregister(struct drm_device *drm_dev)
 	sysfs_remove_bin_file(&dev->kobj, &state_attr);
 	sysfs_remove_bin_file(&dev->kobj, &reg_dump_attr);
 
-	for (i = 0; i < priv->pipeline->num_osds; i++)
+	for (i = 0; i < MESON_MAX_OSDS; i++) {
+		if (!priv->pipeline->osds[i])
+			continue;
 		sysfs_remove_group(&dev->kobj, &osd_attr_group[i]);
-	for (i = 0; i < priv->pipeline->num_postblend; i++)
+	}
+	for (i = 0; i < MESON_MAX_POSTBLEND; i++) {
+		if (!priv->pipeline->postblends[i])
+			continue;
 		sysfs_remove_group(&dev->kobj, &crtc_attr_group[i]);
+	}
 }
 

include/dt-bindings/display/meson-drm-ids.h

@@ -39,7 +39,7 @@
 #define VPP2_BLOCK 21
 #define HDR3_BLOCK 22
 #define SLICE2PPC_BLOCK 23
-#define BLOCK_ID_MAX 29
+#define BLOCK_ID_MAX 32
 
 #define OSD1_PORT 0
 #define OSD2_PORT 1