drm/kmb: fix array bounds warning

Message ID 20201129200927.1854104-1-arnd@kernel.org
State New
Headers show
Series
  • drm/kmb: fix array bounds warning
Related show

Commit Message

Arnd Bergmann Nov. 29, 2020, 8:09 p.m.
From: Arnd Bergmann <arnd@arndb.de>


gcc warns about an out-of-bounds access when the using nonzero
values for 'plane_id' on kmb->plane_status:

drivers/gpu/drm/kmb/kmb_plane.c: In function 'kmb_plane_atomic_disable':
drivers/gpu/drm/kmb/kmb_plane.c:128:20: warning: array subscript 3 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
  128 |   kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL2_ENABLE;
      |   ~~~~~~~~~~~~~~~~~^~~~~~~~~~
drivers/gpu/drm/kmb/kmb_plane.c:125:20: warning: array subscript 2 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
  125 |   kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL1_ENABLE;
      |   ~~~~~~~~~~~~~~~~~^~~~~~~~~~
drivers/gpu/drm/kmb/kmb_plane.c:122:20: warning: array subscript 1 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
  122 |   kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL2_ENABLE;

Having the array truncated to one entry seems intentional, so add
a range check before indexing it to make it clearer what is going
on and shut up the warning.

I received the warning from the kernel test robot after a private
patch that turns on Warray-bounds unconditionally.

Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

---
 drivers/gpu/drm/kmb/kmb_plane.c | 3 +++
 1 file changed, 3 insertions(+)

-- 
2.27.0

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Comments

Chrisanthus, Anitha Nov. 30, 2020, 10:19 p.m. | #1
Hi Arnd,
Thanks for your patch.

> -----Original Message-----

> From: Arnd Bergmann <arnd@kernel.org>

> Sent: Sunday, November 29, 2020 12:09 PM

> To: Chrisanthus, Anitha <anitha.chrisanthus@intel.com>; Dea, Edmund J

> <edmund.j.dea@intel.com>; David Airlie <airlied@linux.ie>; Daniel Vetter

> <daniel@ffwll.ch>; Sam Ravnborg <sam@ravnborg.org>

> Cc: Arnd Bergmann <arnd@arndb.de>; lkp <lkp@intel.com>; dri-

> devel@lists.freedesktop.org; linux-kernel@vger.kernel.org

> Subject: [PATCH] drm/kmb: fix array bounds warning

> 

> From: Arnd Bergmann <arnd@arndb.de>

> 

> gcc warns about an out-of-bounds access when the using nonzero

> values for 'plane_id' on kmb->plane_status:

> 

> drivers/gpu/drm/kmb/kmb_plane.c: In function 'kmb_plane_atomic_disable':

> drivers/gpu/drm/kmb/kmb_plane.c:128:20: warning: array subscript 3 is

> above array bounds of 'struct layer_status[1]' [-Warray-bounds]

>   128 |   kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL2_ENABLE;

>       |   ~~~~~~~~~~~~~~~~~^~~~~~~~~~

> drivers/gpu/drm/kmb/kmb_plane.c:125:20: warning: array subscript 2 is

> above array bounds of 'struct layer_status[1]' [-Warray-bounds]

>   125 |   kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL1_ENABLE;

>       |   ~~~~~~~~~~~~~~~~~^~~~~~~~~~

> drivers/gpu/drm/kmb/kmb_plane.c:122:20: warning: array subscript 1 is

> above array bounds of 'struct layer_status[1]' [-Warray-bounds]

>   122 |   kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL2_ENABLE;

> 

> Having the array truncated to one entry seems intentional, so add

> a range check before indexing it to make it clearer what is going

> on and shut up the warning.

> 

> I received the warning from the kernel test robot after a private

> patch that turns on Warray-bounds unconditionally.

> 

> Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display")

> Reported-by: kernel test robot <lkp@intel.com>

> Signed-off-by: Arnd Bergmann <arnd@arndb.de>

> ---

>  drivers/gpu/drm/kmb/kmb_plane.c | 3 +++

>  1 file changed, 3 insertions(+)

> 

> diff --git a/drivers/gpu/drm/kmb/kmb_plane.c

> b/drivers/gpu/drm/kmb/kmb_plane.c

> index 8448d1edb553..be8eea3830c1 100644

> --- a/drivers/gpu/drm/kmb/kmb_plane.c

> +++ b/drivers/gpu/drm/kmb/kmb_plane.c

> @@ -114,6 +114,9 @@ static void kmb_plane_atomic_disable(struct

> drm_plane *plane,

> 

>  	kmb = to_kmb(plane->dev);

> 

> +	if (WARN_ON(plane_id >= KMB_MAX_PLANES))

> +		return;

> +

Looks good.

Reviewed-by: Anitha Chrisanthus <anitha.chrisanthus@intel.com>

>  	switch (plane_id) {

>  	case LAYER_0:

>  		kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL1_ENABLE;

> --

> 2.27.0


_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
Sam Ravnborg Dec. 5, 2020, 7:59 p.m. | #2
Hi Anitha,
On Mon, Nov 30, 2020 at 10:19:13PM +0000, Chrisanthus, Anitha wrote:
> Hi Arnd,

> Thanks for your patch.

> 

> > -----Original Message-----

> > From: Arnd Bergmann <arnd@kernel.org>

> > Sent: Sunday, November 29, 2020 12:09 PM

> > To: Chrisanthus, Anitha <anitha.chrisanthus@intel.com>; Dea, Edmund J

> > <edmund.j.dea@intel.com>; David Airlie <airlied@linux.ie>; Daniel Vetter

> > <daniel@ffwll.ch>; Sam Ravnborg <sam@ravnborg.org>

> > Cc: Arnd Bergmann <arnd@arndb.de>; lkp <lkp@intel.com>; dri-

> > devel@lists.freedesktop.org; linux-kernel@vger.kernel.org

> > Subject: [PATCH] drm/kmb: fix array bounds warning

> > 

> > From: Arnd Bergmann <arnd@arndb.de>

> > 

> > gcc warns about an out-of-bounds access when the using nonzero

> > values for 'plane_id' on kmb->plane_status:

...

> Looks good.

> 

> Reviewed-by: Anitha Chrisanthus <anitha.chrisanthus@intel.com>


You wanted a little time to get comforable with dim, so I picked up this
patch and pushed it to drm-misc-next.

	Sam
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Patch

diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c
index 8448d1edb553..be8eea3830c1 100644
--- a/drivers/gpu/drm/kmb/kmb_plane.c
+++ b/drivers/gpu/drm/kmb/kmb_plane.c
@@ -114,6 +114,9 @@  static void kmb_plane_atomic_disable(struct drm_plane *plane,
 
 	kmb = to_kmb(plane->dev);
 
+	if (WARN_ON(plane_id >= KMB_MAX_PLANES))
+		return;
+
 	switch (plane_id) {
 	case LAYER_0:
 		kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL1_ENABLE;