Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <13763d3b-bf7f-aaff-3bcd-60e69df86820@amd.com>
Date:   Thu, 29 Sep 2022 11:36:26 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.11.0
Subject: Re: [PATCH] drm/amd/display: fix array-bounds error in
 dc_stream_remove_writeback()
Content-Language: en-US
To:     "Pillai, Aurabindo" <Aurabindo.Pillai@amd.com>,
        "Mahfooz, Hamza" <Hamza.Mahfooz@amd.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc:     "Wang, Chao-kai (Stylon)" <Stylon.Wang@amd.com>,
        "dri-devel@lists.freedesktop.org" <dri-devel@lists.freedesktop.org>,
        "Li, Sun peng (Leo)" <Sunpeng.Li@amd.com>,
        Po-Yu Hsieh Paul <Paul.Hsieh@amd.com>,
        "Pan, Xinhui" <Xinhui.Pan@amd.com>,
        "Siqueira, Rodrigo" <Rodrigo.Siqueira@amd.com>,
        "amd-gfx@lists.freedesktop.org" <amd-gfx@lists.freedesktop.org>,
        David Airlie <airlied@linux.ie>,
        "Hung, Alex" <Alex.Hung@amd.com>,
        "Lee, Alvin" <Alvin.Lee2@amd.com>,
        "Deucher, Alexander" <Alexander.Deucher@amd.com>,
        "Wu, Hersen" <hersenxs.wu@amd.com>,
        "Ma, Leo" <Hanghong.Ma@amd.com>,
        Jimmy Kizito <Jimmy.Kizito@amd.com>,
        "Koenig, Christian" <Christian.Koenig@amd.com>,
        "Kotarac, Pavle" <Pavle.Kotarac@amd.com>
References: <20220927191200.216488-1-hamza.mahfooz@amd.com>
 <CH0PR12MB5284EAC9E9D095B2624631228B559@CH0PR12MB5284.namprd12.prod.outlook.com>
From:   Felix Kuehling <felix.kuehling@amd.com>
In-Reply-To: <CH0PR12MB5284EAC9E9D095B2624631228B559@CH0PR12MB5284.namprd12.prod.outlook.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dnNMZVEzOTJUa0luVGdJQlVFcXE0bmEvNnVwNTJnU2VpcHBoQWJ4QnhVMmps?=
 =?utf-8?B?ZmViWUVoK0Q2SnlCUml1YWJyVlpWL3pqQ2xBOVdNZC80SVo5aUYyanpsT2Ra?=
 =?utf-8?B?RFVZcmtzV2FVZGpqYnQxeDRKVlpSUE44b2JYc2RwUFJpQ3ZjMHFQek1odTgw?=
 =?utf-8?B?K2tUdm8zek40bDdvVklnWTV0djJrdkpXNUVJZXBJdlJOTkFibU9reHJRTFhD?=
 =?utf-8?B?V0JkYkV4VFpOQnNNRzdFazR4MG56cmNCWG83VitWaVpucWtpUU45TGp6eUIw?=
 =?utf-8?B?L21KNXJrWm1BVHpVOEJjdndXemJmODU1SEVvNTZRQ3d5WWV2dXd6UERQN3RB?=
 =?utf-8?B?RURyTUNDbEN0ZUVFaWwzSkU3YlpNeGJKRGRvM1lqbmgxWE5nNVNJeDNOZmJk?=
 =?utf-8?B?ZzFRME9iamtnTTRNU29xMmsxOVEvZ24wNVBsYll4Qkk4WlkyVE9aVUVDM2V6?=
 =?utf-8?B?RFJnbTlXb2RVVTFEcTduUkhjU1hLRWh1VzBGTHNCNEY2RzM2MFdpZlB2TjRB?=
 =?utf-8?B?ZmlOaStvMkg4K29XQk1RRHUwdDdBZ3dMOGV5RmtMREdXczlESElSYUZnK1NF?=
 =?utf-8?B?NDhvaXB4UHZLL1p3cFdteVNqeUtLZjMwUlFLOXZSNVFMa2NQNkJSanlWT0VL?=
 =?utf-8?B?NVZ5ZE0xR0JPRis0NkpOQ1lVNXJqQWFEMnRZNUg1MjA1U2wyTVBMekNVOG9z?=
 =?utf-8?B?UlR5N0VDdGpoNVM3V3RmUUFQNjA4eTBsSzBZSnJCbXVsdFBBOXhPaFlpSjRr?=
 =?utf-8?B?R3ArTkpuR2RqR1ZFTW50dExKYi9mZDZVL012Q3kvREZDL2I0ZC9yRHBXNEFq?=
 =?utf-8?B?QjNvMiszd0JWQUdDaGlIaUt4ZUtQQTM5dFpSSjFtQ0Q1bllWdWVlWlkxLzls?=
 =?utf-8?B?dThhRWswbXdXNm5kWGxCKzRPQ3ZzcFdROUVyQ0lsYTlpTHhTekF4VlRFMGNC?=
 =?utf-8?B?TGpZSElxWXNQWEVhZkIxQ3RZb21IOXRtMWJoeVdBakk2OGNsR2xmWVdvdmxF?=
 =?utf-8?B?UGtjektTUXhKNk80Sk90NmJDVTJKRnNmcWVnLzQyS1VsWXZzVkNHWWF3MEJC?=
 =?utf-8?B?Ty9Md1d2UGtmV1FiVlliOWZud2VBcWRpbldDSGREVWlJS1F0dEhlVy9UZDBh?=
 =?utf-8?B?djJTdHhNdTllRjBsdGUrdE03TmZrWVNkZnZsY1N5SFRlUmxDZEpabnlTT0JE?=
 =?utf-8?B?eld2V0JPdUVUVjhzUzBVcWljbEl3Z3Z4cGo4a2ZhM0dFK2xsNWpiVHEvTVRq?=
 =?utf-8?B?S2k2RGswaWVEd3FjNy9HRmdUMzNtYzRMTDU5bWtLM1dtY2ZhYTEwN3QxUm5M?=
 =?utf-8?B?Z01pYiswc0t3NTJTa1lOUVNRRU0zaXVRT3pJNDY5K0NiZjA0aVpOak4xbnlS?=
 =?utf-8?B?WG5BSnl5M0tTUENwUXNnYW1iMDNPNW5oK3U5MkpXS1BQQ2NUM0ZqK08rWVVx?=
 =?utf-8?B?VlRDQm15OXd5c0c2a0ViWkVMRTVFMERZMTlWSnpHcEFDcnJpdEZSSzVvMFFB?=
 =?utf-8?B?UVg2Q2wrbitwWGNldzlBWU5jbnExVFhVallEcEpMRXNjbkVoczc2dUY3VVFR?=
 =?utf-8?B?d1Y3NlgyYnhyZlNUUmJmMmpWdTkvZnFSNUJBeWRwNi85MEx4RVNIWWpJOGZp?=
 =?utf-8?B?U2JUNEx3bzBiMGhxM2RJOGNPYWtOZVU0Q1IxMGJLTThwMWlNNVBYeitkVDNM?=
 =?utf-8?B?bjIxK1B0QWFHSEwwc3lTR2lhTHpmREYwRzdEdGpwRU9nTWEwWnMyeE9JcXk2?=
 =?utf-8?B?UEFYbEY1VzJpOEdIMTRqaGUzSmdJcjB0dWJ2K1JMa2Q5c2JPaHpNUXJBZUp5?=
 =?utf-8?B?TXpmcGpuL0dEdHJ5ZkxjVTREZnp4TFBRWGNtUENKMENTVkhFUjBEWGViVjQ2?=
 =?utf-8?B?TUFQVnF6MUpvb1piSllqQUJSKzJMdkdrUitKUDZnbEQvbTV5ZGY2VnJJbFJq?=
 =?utf-8?B?TkNkOFVScHNJWSthb2lmV1RNM1dwWmVZa0JuT2YvYWwwWG9wcGRXdUxFcVR5?=
 =?utf-8?B?U0JwbWFDYXkydVFsb2FUaXdnWFZvRFlLQ0RXUVlDWnBSTEs3VURRV1NVOXlu?=
 =?utf-8?B?VldEUnVIYXdBTTlUKzFUN1BPNCtzQ3Iwdml6NzFTSUhhbVNCWDNnWXVQeWEw?=
 =?utf-8?Q?IcLzAdmR9XCuyyB7BtPj+UsO3?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: fb83329c-b0d1-4984-cb10-08daa2306092
X-MS-Exchange-CrossTenant-AuthSource: BN9PR12MB5115.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Sep 2022 15:36:29.1052
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: p4rPpUDsM9000wVG8cMYut8bcQhqE8ORCv1sechJYldZBONRj4Gs+1heRp5fCLRqUyNKSTM7/aiIT14RcgKhGg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV2PR12MB6013
X-Spam-Status: No, score=-6.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,NICE_REPLY_A,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

I'm still seeing a warning even with this fix:

/home/fkuehlin/compute/kernel/drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ?dc_stream_remove_writeback?:
/home/fkuehlin/compute/kernel/drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:527:55: warning: array subscript 1 is above array bounds of ?struct dc_writeback_info[1]? [-Warray-bounds]
   527 |     stream->writeback_info[j] = stream->writeback_info[i];
       |                                 ~~~~~~~~~~~~~~~~~~~~~~^~~

Regards,
   Felix


Am 2022-09-27 um 16:35 schrieb Pillai, Aurabindo:
>
> [AMD Official Use Only - General]
>
>
> [AMD Official Use Only - General]
>
>
> Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
>
> --
>
> Regards,
> Jay
> ------------------------------------------------------------------------
> *From:* Mahfooz, Hamza <Hamza.Mahfooz@amd.com>
> *Sent:* Tuesday, September 27, 2022 3:12 PM
> *To:* linux-kernel@vger.kernel.org <linux-kernel@vger.kernel.org>
> *Cc:* Mahfooz, Hamza <Hamza.Mahfooz@amd.com>; Wentland, Harry 
> <Harry.Wentland@amd.com>; Li, Sun peng (Leo) <Sunpeng.Li@amd.com>; 
> Siqueira, Rodrigo <Rodrigo.Siqueira@amd.com>; Deucher, Alexander 
> <Alexander.Deucher@amd.com>; Koenig, Christian 
> <Christian.Koenig@amd.com>; Pan, Xinhui <Xinhui.Pan@amd.com>; David 
> Airlie <airlied@linux.ie>; Daniel Vetter <daniel@ffwll.ch>; Lee, Alvin 
> <Alvin.Lee2@amd.com>; Hung, Alex <Alex.Hung@amd.com>; Kotarac, Pavle 
> <Pavle.Kotarac@amd.com>; Wang, Chao-kai (Stylon) 
> <Stylon.Wang@amd.com>; Pillai, Aurabindo <Aurabindo.Pillai@amd.com>; 
> Ma, Leo <Hanghong.Ma@amd.com>; Wu, Hersen <hersenxs.wu@amd.com>; Po-Yu 
> Hsieh Paul <Paul.Hsieh@amd.com>; Jimmy Kizito <Jimmy.Kizito@amd.com>; 
> amd-gfx@lists.freedesktop.org <amd-gfx@lists.freedesktop.org>; 
> dri-devel@lists.freedesktop.org <dri-devel@lists.freedesktop.org>
> *Subject:* [PATCH] drm/amd/display: fix array-bounds error in 
> dc_stream_remove_writeback()
> Address the following error:
> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function 
> ‘dc_stream_remove_writeback’:
> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:527:55: 
> error: array subscript [0, 0] is outside array bounds of ‘struct 
> dc_writeback_info[1]’ [-Werror=array-bounds]
>   527 | stream->writeback_info[j] = stream->writeback_info[i];
>       | ~~~~~~~~~~~~~~~~~~~~~~^~~
> In file included from 
> ./drivers/gpu/drm/amd/amdgpu/../display/dc/dc.h:1269,
>                  from 
> ./drivers/gpu/drm/amd/amdgpu/../display/dc/inc/core_types.h:29,
>                  from 
> ./drivers/gpu/drm/amd/amdgpu/../display/dc/basics/dc_common.h:29,
>                  from 
> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:27:
> ./drivers/gpu/drm/amd/amdgpu/../display/dc/dc_stream.h:241:34: note: 
> while referencing ‘writeback_info’
>   241 |         struct dc_writeback_info writeback_info[MAX_DWB_PIPES];
>       |
>
> Currently, we aren't checking to see if j remains within
> writeback_info[]'s bounds. So, add a check to make sure that we aren't
> overflowing the buffer.
>
> Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
> ---
>  drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
> b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> index 3ca1592ce7ac..ae13887756bf 100644
> --- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> +++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> @@ -520,7 +520,7 @@ bool dc_stream_remove_writeback(struct dc *dc,
>          }
>
>          /* remove writeback info for disabled writeback pipes from 
> stream */
> -       for (i = 0, j = 0; i < stream->num_wb_info; i++) {
> +       for (i = 0, j = 0; i < stream->num_wb_info && j < 
> MAX_DWB_PIPES; i++) {
>                  if (stream->writeback_info[i].wb_enabled) {
>                          if (i != j)
>                                  /* trim the array */
> -- 
> 2.37.2
>