Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230204184307.never.825-kees@kernel.org> <0a48d61b-6e11-9144-b11e-dd46de836c53@embeddedor.com>
In-Reply-To: <0a48d61b-6e11-9144-b11e-dd46de836c53@embeddedor.com>
From:   Karol Herbst <kherbst@redhat.com>
Date:   Mon, 24 Apr 2023 17:20:16 +0200
Message-ID: <CACO55tv43F7TQGYCmifyzOxR-Ddt28wpj9t9RyK4sQPR6aU+bQ@mail.gmail.com>
Subject: Re: [PATCH] drm/nouveau/disp: More DP_RECEIVER_CAP_SIZE array fixes
To:     "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Cc:     Kees Cook <keescook@chromium.org>, Ben Skeggs <bskeggs@redhat.com>,
        Lyude Paul <lyude@redhat.com>,
        David Airlie <airlied@gmail.com>,
        Daniel Vetter <daniel@ffwll.ch>,
        Dave Airlie <airlied@redhat.com>,
        dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org,
        linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Wed, Mar 22, 2023 at 10:40=E2=80=AFPM Gustavo A. R. Silva
<gustavo@embeddedor.com> wrote:
>
>
>
> On 2/4/23 12:43, Kees Cook wrote:
> > More arrays (and arguments) for dcpd were set to 16, when it looks like
> > DP_RECEIVER_CAP_SIZE (15) should be used. Fix the remaining cases, seen
> > with GCC 13:
> >
> > ../drivers/gpu/drm/nouveau/nvif/outp.c: In function 'nvif_outp_acquire_=
dp':
> > ../include/linux/fortify-string.h:57:33: warning: array subscript 'unsi=
gned char[16][0]' is partly outside array bounds of 'u8[15]' {aka 'unsigned=
 char[15]'} [-Warray-bounds=3D]
> >     57 | #define __underlying_memcpy     __builtin_memcpy
> >        |                                 ^
> > ...
> > ../drivers/gpu/drm/nouveau/nvif/outp.c:140:9: note: in expansion of mac=
ro 'memcpy'
> >    140 |         memcpy(args.dp.dpcd, dpcd, sizeof(args.dp.dpcd));
> >        |         ^~~~~~
> > ../drivers/gpu/drm/nouveau/nvif/outp.c:130:49: note: object 'dpcd' of s=
ize [0, 15]
> >    130 | nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[DP_RECEIV=
ER_CAP_SIZE],
> >        |                                              ~~~^~~~~~~~~~~~~~=
~~~~~~~~~~~~
> >
> > Fixes: 813443721331 ("drm/nouveau/disp: move DP link config into acquir=
e")
> > Cc: Ben Skeggs <bskeggs@redhat.com>
> > Cc: Lyude Paul <lyude@redhat.com>
> > Cc: Karol Herbst <kherbst@redhat.com>
> > Cc: David Airlie <airlied@gmail.com>
> > Cc: Daniel Vetter <daniel@ffwll.ch>
> > Cc: Dave Airlie <airlied@redhat.com>
> > Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
> > Cc: dri-devel@lists.freedesktop.org
> > Cc: nouveau@lists.freedesktop.org
> > Signed-off-by: Kees Cook <keescook@chromium.org>
>
> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
>

Reviewed-by: Karol Herbst <kherbst@redhat.com>

sorry for not seeing this earlier.

> Thanks!
> --
> Gustavo
>
> > ---
> >   drivers/gpu/drm/nouveau/include/nvif/if0012.h    | 4 +++-
> >   drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h  | 3 ++-
> >   drivers/gpu/drm/nouveau/nvkm/engine/disp/uoutp.c | 2 +-
> >   3 files changed, 6 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/nouveau/include/nvif/if0012.h b/drivers/gp=
u/drm/nouveau/include/nvif/if0012.h
> > index eb99d84eb844..16d4ad5023a3 100644
> > --- a/drivers/gpu/drm/nouveau/include/nvif/if0012.h
> > +++ b/drivers/gpu/drm/nouveau/include/nvif/if0012.h
> > @@ -2,6 +2,8 @@
> >   #ifndef __NVIF_IF0012_H__
> >   #define __NVIF_IF0012_H__
> >
> > +#include <drm/display/drm_dp.h>
> > +
> >   union nvif_outp_args {
> >       struct nvif_outp_v0 {
> >               __u8 version;
> > @@ -63,7 +65,7 @@ union nvif_outp_acquire_args {
> >                               __u8 hda;
> >                               __u8 mst;
> >                               __u8 pad04[4];
> > -                             __u8 dpcd[16];
> > +                             __u8 dpcd[DP_RECEIVER_CAP_SIZE];
> >                       } dp;
> >               };
> >       } v0;
> > diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h b/drivers/=
gpu/drm/nouveau/nvkm/engine/disp/outp.h
> > index b7631c1ab242..4e7f873f66e2 100644
> > --- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
> > +++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.h
> > @@ -3,6 +3,7 @@
> >   #define __NVKM_DISP_OUTP_H__
> >   #include "priv.h"
> >
> > +#include <drm/display/drm_dp.h>
> >   #include <subdev/bios.h>
> >   #include <subdev/bios/dcb.h>
> >   #include <subdev/bios/dp.h>
> > @@ -42,7 +43,7 @@ struct nvkm_outp {
> >                       bool aux_pwr_pu;
> >                       u8 lttpr[6];
> >                       u8 lttprs;
> > -                     u8 dpcd[16];
> > +                     u8 dpcd[DP_RECEIVER_CAP_SIZE];
> >
> >                       struct {
> >                               int dpcd; /* -1, or index into SUPPORTED_=
LINK_RATES table */
> > diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/uoutp.c b/drivers=
/gpu/drm/nouveau/nvkm/engine/disp/uoutp.c
> > index 4f0ca709c85a..fc283a4a1522 100644
> > --- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/uoutp.c
> > +++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/uoutp.c
> > @@ -146,7 +146,7 @@ nvkm_uoutp_mthd_release(struct nvkm_outp *outp, voi=
d *argv, u32 argc)
> >   }
> >
> >   static int
> > -nvkm_uoutp_mthd_acquire_dp(struct nvkm_outp *outp, u8 dpcd[16],
> > +nvkm_uoutp_mthd_acquire_dp(struct nvkm_outp *outp, u8 dpcd[DP_RECEIVER=
_CAP_SIZE],
> >                          u8 link_nr, u8 link_bw, bool hda, bool mst)
> >   {
> >       int ret;
>