Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Kees Cook <keescook@chromium.org>
To:     Anitha Chrisanthus <anitha.chrisanthus@intel.com>
Cc:     Kees Cook <keescook@chromium.org>,
        Edmund Dea <edmund.j.dea@intel.com>,
        David Airlie <airlied@linux.ie>,
        Daniel Vetter <daniel@ffwll.ch>,
        dri-devel@lists.freedesktop.org, Sam Ravnborg <sam@ravnborg.org>,
        linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: [PATCH] drm/kmb: Avoid warnings on impossible plane_id
Date:   Wed, 25 Aug 2021 11:18:07 -0700
Message-Id: <20210825181807.1138053-1-keescook@chromium.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

KMB_MAX_PLANES is defined as 1, yet kmb_plane_atomic_disable() had code
for writing beyond 1. It is gated by a WARN_ON() that would skip it,
though, but under some compiler versions, poor Dead Code Elimination
wasn't optimizing away the unused switch cases, leading to array bounds
warnings when building with -Warray-bounds:

drivers/gpu/drm/kmb/kmb_plane.c:135:20: warning: array subscript 3 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
drivers/gpu/drm/kmb/kmb_plane.c:132:20: warning: array subscript 2 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
drivers/gpu/drm/kmb/kmb_plane.c:129:20: warning: array subscript 1 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]

Instead, just remove the switch statement entirely and adjust the index
type to match the struct "id" member.

Cc: Anitha Chrisanthus <anitha.chrisanthus@intel.com>
Cc: Edmund Dea <edmund.j.dea@intel.com>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: dri-devel@lists.freedesktop.org
Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display")
Signed-off-by: Kees Cook <keescook@chromium.org>
---
 drivers/gpu/drm/kmb/kmb_plane.c | 18 ++----------------
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c
index ecee6782612d..3d46e756f2fe 100644
--- a/drivers/gpu/drm/kmb/kmb_plane.c
+++ b/drivers/gpu/drm/kmb/kmb_plane.c
@@ -113,7 +113,7 @@ static void kmb_plane_atomic_disable(struct drm_plane *plane,
 				     struct drm_atomic_state *state)
 {
 	struct kmb_plane *kmb_plane = to_kmb_plane(plane);
-	int plane_id = kmb_plane->id;
+	unsigned char plane_id = kmb_plane->id;
 	struct kmb_drm_private *kmb;
 
 	kmb = to_kmb(plane->dev);
@@ -121,21 +121,7 @@ static void kmb_plane_atomic_disable(struct drm_plane *plane,
 	if (WARN_ON(plane_id >= KMB_MAX_PLANES))
 		return;
 
-	switch (plane_id) {
-	case LAYER_0:
-		kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL1_ENABLE;
-		break;
-	case LAYER_1:
-		kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL2_ENABLE;
-		break;
-	case LAYER_2:
-		kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL1_ENABLE;
-		break;
-	case LAYER_3:
-		kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL2_ENABLE;
-		break;
-	}
-
+	kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL1_ENABLE;
 	kmb->plane_status[plane_id].disable = true;
 }
 
-- 
2.30.2