DF-4375 / run.log
===RUN===
transmitter= 5 ((in-bounds transmitter))
link_enc_regs[5] (array size 7) ok
link_enc_aux_regs[5 (6-1)] (array size 6) ok
link_enc_hpd_regs[5] (array size 6) ok
=> all in bounds (sanity row)
transmitter=-1 (TRANSMITTER_UNKNOWN)
link_enc_regs[-1] (array size 7) <-- OOB
link_enc_aux_regs[5 (6-1)] (array size 6) ok
link_enc_hpd_regs[5] (array size 6) ok
=> kernel equivalent reads a struct beyond the const table;
stored as the encoder's register base (wild MMIO offsets)
transmitter= 9 (TRANSMITTER_UNIPHY_G)
link_enc_regs[9] (array size 7) <-- OOB
link_enc_aux_regs[0 (1-1)] (array size 6) ok
link_enc_hpd_regs[0] (array size 6) ok
=> kernel equivalent reads a struct beyond the const table;
stored as the encoder's register base (wild MMIO offsets)
transmitter= 7 (TRANSMITTER_TRAVIS_CRT)
link_enc_regs[7] (array size 7) <-- OOB
link_enc_aux_regs[6 (7-1)] (array size 6) <-- OOB
link_enc_hpd_regs[7] (array size 6) <-- OOB
=> kernel equivalent reads a struct beyond the const table;
stored as the encoder's register base (wild MMIO offsets)
transmitter= 8 (TRANSMITTER_TRAVIS_LCD)
link_enc_regs[8] (array size 7) <-- OOB
link_enc_aux_regs[7 (8-1)] (array size 6) <-- OOB
link_enc_hpd_regs[7] (array size 6) <-- OOB
=> kernel equivalent reads a struct beyond the const table;
stored as the encoder's register base (wild MMIO offsets)
transmitter= 0 ((in-bounds transmitter))
link_enc_regs[0] (array size 7) ok
link_enc_aux_regs[-1 (0-1)] (array size 6) <-- OOB
link_enc_hpd_regs[7] (array size 6) <-- OOB
=> kernel equivalent reads a struct beyond the const table;
stored as the encoder's register base (wild MMIO offsets)
DONE: every OOB row above is an out-of-bounds read in
dce112_resource.c:577-579 (see ASan report; exit code follows)
RUN_EXIT=0