2020-11-29 20:14:06

by Arnd Bergmann

[permalink] [raw]
Subject: [PATCH] drm/kmb: fix array bounds warning

From: Arnd Bergmann <[email protected]>

gcc warns about an out-of-bounds access when the using nonzero
values for 'plane_id' on kmb->plane_status:

drivers/gpu/drm/kmb/kmb_plane.c: In function 'kmb_plane_atomic_disable':
drivers/gpu/drm/kmb/kmb_plane.c:128:20: warning: array subscript 3 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
128 | kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL2_ENABLE;
| ~~~~~~~~~~~~~~~~~^~~~~~~~~~
drivers/gpu/drm/kmb/kmb_plane.c:125:20: warning: array subscript 2 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
125 | kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL1_ENABLE;
| ~~~~~~~~~~~~~~~~~^~~~~~~~~~
drivers/gpu/drm/kmb/kmb_plane.c:122:20: warning: array subscript 1 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
122 | kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL2_ENABLE;

Having the array truncated to one entry seems intentional, so add
a range check before indexing it to make it clearer what is going
on and shut up the warning.

I received the warning from the kernel test robot after a private
patch that turns on Warray-bounds unconditionally.

Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display")
Reported-by: kernel test robot <[email protected]>
Signed-off-by: Arnd Bergmann <[email protected]>
---
drivers/gpu/drm/kmb/kmb_plane.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c
index 8448d1edb553..be8eea3830c1 100644
--- a/drivers/gpu/drm/kmb/kmb_plane.c
+++ b/drivers/gpu/drm/kmb/kmb_plane.c
@@ -114,6 +114,9 @@ static void kmb_plane_atomic_disable(struct drm_plane *plane,

kmb = to_kmb(plane->dev);

+ if (WARN_ON(plane_id >= KMB_MAX_PLANES))
+ return;
+
switch (plane_id) {
case LAYER_0:
kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL1_ENABLE;
--
2.27.0


2020-12-01 04:58:56

by Chrisanthus, Anitha

[permalink] [raw]
Subject: RE: [PATCH] drm/kmb: fix array bounds warning

Hi Arnd,
Thanks for your patch.

> -----Original Message-----
> From: Arnd Bergmann <[email protected]>
> Sent: Sunday, November 29, 2020 12:09 PM
> To: Chrisanthus, Anitha <[email protected]>; Dea, Edmund J
> <[email protected]>; David Airlie <[email protected]>; Daniel Vetter
> <[email protected]>; Sam Ravnborg <[email protected]>
> Cc: Arnd Bergmann <[email protected]>; lkp <[email protected]>; dri-
> [email protected]; [email protected]
> Subject: [PATCH] drm/kmb: fix array bounds warning
>
> From: Arnd Bergmann <[email protected]>
>
> gcc warns about an out-of-bounds access when the using nonzero
> values for 'plane_id' on kmb->plane_status:
>
> drivers/gpu/drm/kmb/kmb_plane.c: In function 'kmb_plane_atomic_disable':
> drivers/gpu/drm/kmb/kmb_plane.c:128:20: warning: array subscript 3 is
> above array bounds of 'struct layer_status[1]' [-Warray-bounds]
> 128 | kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL2_ENABLE;
> | ~~~~~~~~~~~~~~~~~^~~~~~~~~~
> drivers/gpu/drm/kmb/kmb_plane.c:125:20: warning: array subscript 2 is
> above array bounds of 'struct layer_status[1]' [-Warray-bounds]
> 125 | kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL1_ENABLE;
> | ~~~~~~~~~~~~~~~~~^~~~~~~~~~
> drivers/gpu/drm/kmb/kmb_plane.c:122:20: warning: array subscript 1 is
> above array bounds of 'struct layer_status[1]' [-Warray-bounds]
> 122 | kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL2_ENABLE;
>
> Having the array truncated to one entry seems intentional, so add
> a range check before indexing it to make it clearer what is going
> on and shut up the warning.
>
> I received the warning from the kernel test robot after a private
> patch that turns on Warray-bounds unconditionally.
>
> Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display")
> Reported-by: kernel test robot <[email protected]>
> Signed-off-by: Arnd Bergmann <[email protected]>
> ---
> drivers/gpu/drm/kmb/kmb_plane.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/kmb/kmb_plane.c
> b/drivers/gpu/drm/kmb/kmb_plane.c
> index 8448d1edb553..be8eea3830c1 100644
> --- a/drivers/gpu/drm/kmb/kmb_plane.c
> +++ b/drivers/gpu/drm/kmb/kmb_plane.c
> @@ -114,6 +114,9 @@ static void kmb_plane_atomic_disable(struct
> drm_plane *plane,
>
> kmb = to_kmb(plane->dev);
>
> + if (WARN_ON(plane_id >= KMB_MAX_PLANES))
> + return;
> +
Looks good.

Reviewed-by: Anitha Chrisanthus <[email protected]>
> switch (plane_id) {
> case LAYER_0:
> kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL1_ENABLE;
> --
> 2.27.0

2020-12-05 20:02:45

by Sam Ravnborg

[permalink] [raw]
Subject: Re: [PATCH] drm/kmb: fix array bounds warning

Hi Anitha,
On Mon, Nov 30, 2020 at 10:19:13PM +0000, Chrisanthus, Anitha wrote:
> Hi Arnd,
> Thanks for your patch.
>
> > -----Original Message-----
> > From: Arnd Bergmann <[email protected]>
> > Sent: Sunday, November 29, 2020 12:09 PM
> > To: Chrisanthus, Anitha <[email protected]>; Dea, Edmund J
> > <[email protected]>; David Airlie <[email protected]>; Daniel Vetter
> > <[email protected]>; Sam Ravnborg <[email protected]>
> > Cc: Arnd Bergmann <[email protected]>; lkp <[email protected]>; dri-
> > [email protected]; [email protected]
> > Subject: [PATCH] drm/kmb: fix array bounds warning
> >
> > From: Arnd Bergmann <[email protected]>
> >
> > gcc warns about an out-of-bounds access when the using nonzero
> > values for 'plane_id' on kmb->plane_status:
...

> Looks good.
>
> Reviewed-by: Anitha Chrisanthus <[email protected]>

You wanted a little time to get comforable with dim, so I picked up this
patch and pushed it to drm-misc-next.

Sam