* Re: [PATCH 4/4] drm/gem: Warn on trying to use a non-existing framebuffer plane
@ 2022-05-13 13:35 kernel test robot
0 siblings, 0 replies; 3+ messages in thread
From: kernel test robot @ 2022-05-13 13:35 UTC (permalink / raw)
To: kbuild
[-- Attachment #1: Type: text/plain, Size: 18609 bytes --]
CC: llvm(a)lists.linux.dev
CC: kbuild-all(a)lists.01.org
BCC: lkp(a)intel.com
In-Reply-To: <20220509081602.474-5-tzimmermann@suse.de>
References: <20220509081602.474-5-tzimmermann@suse.de>
TO: Thomas Zimmermann <tzimmermann@suse.de>
TO: daniel(a)ffwll.ch
TO: airlied(a)linux.ie
TO: mripard(a)kernel.org
TO: maarten.lankhorst(a)linux.intel.com
TO: noralf(a)tronnes.org
TO: christian.koenig(a)amd.com
CC: Thomas Zimmermann <tzimmermann@suse.de>
CC: dri-devel(a)lists.freedesktop.org
Hi Thomas,
I love your patch! Perhaps something to improve:
[auto build test WARNING on b0b93865a24c910fcbfa6e6fa0955fae930a56d3]
url: https://github.com/intel-lab-lkp/linux/commits/Thomas-Zimmermann/drm-Ignore-non-existing-color-planes-in-helpers/20220509-161931
base: b0b93865a24c910fcbfa6e6fa0955fae930a56d3
:::::: branch date: 4 days ago
:::::: commit date: 4 days ago
config: arm-randconfig-c002-20220512 (https://download.01.org/0day-ci/archive/20220513/202205132133.TO6CH9hx-lkp(a)intel.com/config)
compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project 9519dacab7b8afd537811fc2abaceb4d14f4e16a)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install arm cross compiling tool for clang build
# apt-get install binutils-arm-linux-gnueabi
# https://github.com/intel-lab-lkp/linux/commit/74626e0c7dc11284a12f3e8c046612eec6e7bc4e
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Thomas-Zimmermann/drm-Ignore-non-existing-color-planes-in-helpers/20220509-161931
git checkout 74626e0c7dc11284a12f3e8c046612eec6e7bc4e
# save the config file
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=arm clang-analyzer
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
clang-analyzer warnings: (new ones prefixed by >>)
^~~
lib/mpi/mpi-pow.c:71:2: note: Taking false branch
if (!mp)
^
lib/mpi/mpi-pow.c:74:6: note: 'mod_shift_cnt' is 32
if (mod_shift_cnt)
^~~~~~~~~~~~~
lib/mpi/mpi-pow.c:74:2: note: Taking true branch
if (mod_shift_cnt)
^
lib/mpi/mpi-pow.c:81:6: note: Assuming 'bsize' is <= 'msize'
if (bsize > msize) { /* The base is larger than the module. Reduce it. */
^~~~~~~~~~~~~
lib/mpi/mpi-pow.c:81:2: note: Taking false branch
if (bsize > msize) { /* The base is larger than the module. Reduce it. */
^
lib/mpi/mpi-pow.c:98:6: note: Assuming 'bsize' is not equal to 0
if (!bsize) {
^~~~~~
lib/mpi/mpi-pow.c:98:2: note: Taking false branch
if (!bsize) {
^
lib/mpi/mpi-pow.c:104:6: note: Assuming 'size' is <= field 'alloced'
if (res->alloced < size) {
^~~~~~~~~~~~~~~~~~~
lib/mpi/mpi-pow.c:104:2: note: Taking false branch
if (res->alloced < size) {
^
lib/mpi/mpi-pow.c:119:7: note: Assuming 'rp' is not equal to 'bp'
if (rp == bp) {
^~~~~~~~
lib/mpi/mpi-pow.c:119:3: note: Taking false branch
if (rp == bp) {
^
lib/mpi/mpi-pow.c:127:7: note: Assuming 'rp' is not equal to 'ep'
if (rp == ep) {
^~~~~~~~
lib/mpi/mpi-pow.c:127:3: note: Taking false branch
if (rp == ep) {
^
lib/mpi/mpi-pow.c:134:7: note: Assuming 'rp' is not equal to 'mp'
if (rp == mp) {
^~~~~~~~
lib/mpi/mpi-pow.c:134:3: note: Taking false branch
if (rp == mp) {
^
lib/mpi/mpi-pow.c:144:2: note: Assuming '_i' is >= 'bsize'
MPN_COPY(rp, bp, bsize);
^
lib/mpi/mpi-internal.h:65:16: note: expanded from macro 'MPN_COPY'
for (_i = 0; _i < (n); _i++) \
^~~~~~~~
lib/mpi/mpi-pow.c:144:2: note: Loop condition is false. Execution continues on line 144
MPN_COPY(rp, bp, bsize);
^
lib/mpi/mpi-internal.h:65:3: note: expanded from macro 'MPN_COPY'
for (_i = 0; _i < (n); _i++) \
^
lib/mpi/mpi-pow.c:144:2: note: Loop condition is false. Exiting loop
MPN_COPY(rp, bp, bsize);
^
lib/mpi/mpi-internal.h:63:2: note: expanded from macro 'MPN_COPY'
do { \
^
lib/mpi/mpi-pow.c:156:7: note: Assuming 'xp' is non-null
if (!xp)
^~~
lib/mpi/mpi-pow.c:156:3: note: Taking false branch
if (!xp)
^
lib/mpi/mpi-pow.c:159:22: note: Assuming the condition is false
negative_result = (ep[0] & 1) && base->sign;
^~~~~~~~~
lib/mpi/mpi-pow.c:159:33: note: Left side of '&&' is false
negative_result = (ep[0] & 1) && base->sign;
^
lib/mpi/mpi-pow.c:163:7: note: Calling 'count_leading_zeros'
c = count_leading_zeros(e);
^~~~~~~~~~~~~~~~~~~~~~
include/linux/count_zeros.h:25:2: note: Taking true branch
if (sizeof(x) == 4)
^
include/linux/count_zeros.h:26:3: note: Returning the value 32
return BITS_PER_LONG - fls(x);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/mpi/mpi-pow.c:163:7: note: Returning from 'count_leading_zeros'
c = count_leading_zeros(e);
^~~~~~~~~~~~~~~~~~~~~~
lib/mpi/mpi-pow.c:163:3: note: The value 32 is assigned to 'c'
c = count_leading_zeros(e);
^~~~~~~~~~~~~~~~~~~~~~~~~~
lib/mpi/mpi-pow.c:164:10: note: The result of the left shift is undefined due to shifting by '32', which is greater or equal to the width of type 'mpi_limb_t'
e = (e << c) << 1; /* shift the exp bits to the left, lose msb */
^ ~
Suppressed 37 warnings (37 in non-user code).
Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
22 warnings generated.
Suppressed 22 warnings (22 in non-user code).
Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
55 warnings generated.
>> drivers/gpu/drm/drm_gem_framebuffer_helper.c:56:21: warning: Value stored to 'dev' during its initialization is never read [clang-analyzer-deadcode.DeadStores]
struct drm_device *dev = fb->dev;
^~~ ~~~~~~~
drivers/gpu/drm/drm_gem_framebuffer_helper.c:56:21: note: Value stored to 'dev' during its initialization is never read
struct drm_device *dev = fb->dev;
^~~ ~~~~~~~
drivers/gpu/drm/drm_gem_framebuffer_helper.c:364:4: warning: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
memcpy(&data[i], &map[i], sizeof(data[i]));
^
include/linux/fortify-string.h:369:26: note: expanded from macro 'memcpy'
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/fortify-string.h:362:2: note: expanded from macro '__fortify_memcpy_chk'
__underlying_##op(p, q, __fortify_size); \
^~~~~~~~~~~~~~~~~
note: expanded from here
include/linux/fortify-string.h:45:29: note: expanded from macro '__underlying_memcpy'
#define __underlying_memcpy __builtin_memcpy
^~~~~~~~~~~~~~~~
drivers/gpu/drm/drm_gem_framebuffer_helper.c:364:4: note: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11
memcpy(&data[i], &map[i], sizeof(data[i]));
^
include/linux/fortify-string.h:369:26: note: expanded from macro 'memcpy'
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/fortify-string.h:362:2: note: expanded from macro '__fortify_memcpy_chk'
__underlying_##op(p, q, __fortify_size); \
^~~~~~~~~~~~~~~~~
note: expanded from here
include/linux/fortify-string.h:45:29: note: expanded from macro '__underlying_memcpy'
#define __underlying_memcpy __builtin_memcpy
^~~~~~~~~~~~~~~~
Suppressed 53 warnings (53 in non-user code).
Use -header-filter=.* to display errors from all non-system headers. Use -system-headers to display errors from system headers as well.
54 warnings generated.
drivers/gpu/drm/drm_atomic_state_helper.c:134:2: warning: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
memcpy(state, crtc->state, sizeof(*state));
^
include/linux/fortify-string.h:369:26: note: expanded from macro 'memcpy'
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/fortify-string.h:362:2: note: expanded from macro '__fortify_memcpy_chk'
__underlying_##op(p, q, __fortify_size); \
^~~~~~~~~~~~~~~~~
note: expanded from here
include/linux/fortify-string.h:45:29: note: expanded from macro '__underlying_memcpy'
#define __underlying_memcpy __builtin_memcpy
^~~~~~~~~~~~~~~~
drivers/gpu/drm/drm_atomic_state_helper.c:134:2: note: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11
memcpy(state, crtc->state, sizeof(*state));
^
include/linux/fortify-string.h:369:26: note: expanded from macro 'memcpy'
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/fortify-string.h:362:2: note: expanded from macro '__fortify_memcpy_chk'
__underlying_##op(p, q, __fortify_size); \
^~~~~~~~~~~~~~~~~
note: expanded from here
include/linux/fortify-string.h:45:29: note: expanded from macro '__underlying_memcpy'
#define __underlying_memcpy __builtin_memcpy
^~~~~~~~~~~~~~~~
drivers/gpu/drm/drm_atomic_state_helper.c:331:2: warning: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
memcpy(state, plane->state, sizeof(*state));
^
include/linux/fortify-string.h:369:26: note: expanded from macro 'memcpy'
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/fortify-string.h:362:2: note: expanded from macro '__fortify_memcpy_chk'
__underlying_##op(p, q, __fortify_size); \
^~~~~~~~~~~~~~~~~
note: expanded from here
include/linux/fortify-string.h:45:29: note: expanded from macro '__underlying_memcpy'
#define __underlying_memcpy __builtin_memcpy
^~~~~~~~~~~~~~~~
drivers/gpu/drm/drm_atomic_state_helper.c:331:2: note: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11
memcpy(state, plane->state, sizeof(*state));
^
include/linux/fortify-string.h:369:26: note: expanded from macro 'memcpy'
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/fortify-string.h:362:2: note: expanded from macro '__fortify_memcpy_chk'
__underlying_##op(p, q, __fortify_size); \
^~~~~~~~~~~~~~~~~
note: expanded from here
include/linux/fortify-string.h:45:29: note: expanded from macro '__underlying_memcpy'
#define __underlying_memcpy __builtin_memcpy
^~~~~~~~~~~~~~~~
drivers/gpu/drm/drm_atomic_state_helper.c:494:2: warning: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11 [clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]
memcpy(state, connector->state, sizeof(*state));
^
include/linux/fortify-string.h:369:26: note: expanded from macro 'memcpy'
#define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/fortify-string.h:362:2: note: expanded from macro '__fortify_memcpy_chk'
__underlying_##op(p, q, __fortify_size); \
^~~~~~~~~~~~~~~~~
note: expanded from here
include/linux/fortify-string.h:45:29: note: expanded from macro '__underlying_memcpy'
#define __underlying_memcpy __builtin_memcpy
^~~~~~~~~~~~~~~~
drivers/gpu/drm/drm_atomic_state_helper.c:494:2: note: Call to function 'memcpy' is insecure as it does not provide security checks introduced in the C11 standard. Replace with analogous functions that support length arguments or provides boundary checks such as 'memcpy_s' in case of C11
vim +/dev +56 drivers/gpu/drm/drm_gem_framebuffer_helper.c
55f7f72753abdd Andrzej Pietrasiewicz 2020-03-11 29
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 30 /**
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 31 * DOC: overview
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 32 *
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 33 * This library provides helpers for drivers that don't subclass
2e187b2099034a Noralf Trønnes 2017-09-22 34 * &drm_framebuffer and use &drm_gem_object for their backing storage.
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 35 *
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 36 * Drivers without additional needs to validate framebuffers can simply use
2e187b2099034a Noralf Trønnes 2017-09-22 37 * drm_gem_fb_create() and everything is wired up automatically. Other drivers
2e187b2099034a Noralf Trønnes 2017-09-22 38 * can use all parts independently.
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 39 */
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 40
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 41 /**
2e187b2099034a Noralf Trønnes 2017-09-22 42 * drm_gem_fb_get_obj() - Get GEM object backing the framebuffer
2e187b2099034a Noralf Trønnes 2017-09-22 43 * @fb: Framebuffer
2e187b2099034a Noralf Trønnes 2017-09-22 44 * @plane: Plane index
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 45 *
2e187b2099034a Noralf Trønnes 2017-09-22 46 * No additional reference is taken beyond the one that the &drm_frambuffer
2e187b2099034a Noralf Trønnes 2017-09-22 47 * already holds.
2e187b2099034a Noralf Trønnes 2017-09-22 48 *
2e187b2099034a Noralf Trønnes 2017-09-22 49 * Returns:
2e187b2099034a Noralf Trønnes 2017-09-22 50 * Pointer to &drm_gem_object for the given framebuffer and plane index or NULL
2e187b2099034a Noralf Trønnes 2017-09-22 51 * if it does not exist.
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 52 */
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 53 struct drm_gem_object *drm_gem_fb_get_obj(struct drm_framebuffer *fb,
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 54 unsigned int plane)
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 55 {
74626e0c7dc112 Thomas Zimmermann 2022-05-09 @56 struct drm_device *dev = fb->dev;
74626e0c7dc112 Thomas Zimmermann 2022-05-09 57
74626e0c7dc112 Thomas Zimmermann 2022-05-09 58 if (drm_WARN_ON_ONCE(dev, plane >= ARRAY_SIZE(fb->obj)))
74626e0c7dc112 Thomas Zimmermann 2022-05-09 59 return NULL;
74626e0c7dc112 Thomas Zimmermann 2022-05-09 60 else if (drm_WARN_ON_ONCE(dev, !fb->obj[plane]))
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 61 return NULL;
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 62
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 63 return fb->obj[plane];
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 64 }
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 65 EXPORT_SYMBOL_GPL(drm_gem_fb_get_obj);
4c3dbb2c312c9f Noralf Trønnes 2017-08-13 66
--
0-DAY CI Kernel Test Service
https://01.org/lkp
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH 4/4] drm/gem: Warn on trying to use a non-existing framebuffer plane
2022-05-09 8:16 ` [PATCH 4/4] drm/gem: Warn on trying to use a non-existing framebuffer plane Thomas Zimmermann
@ 2022-05-16 13:35 ` Javier Martinez Canillas
0 siblings, 0 replies; 3+ messages in thread
From: Javier Martinez Canillas @ 2022-05-16 13:35 UTC (permalink / raw)
To: Thomas Zimmermann, daniel, airlied, mripard, maarten.lankhorst,
noralf, christian.koenig
Cc: dri-devel
On 5/9/22 10:16, Thomas Zimmermann wrote:
> Warn if callers of drm_gem_fb_get_obj() try to use a GEM buffer for
> a non-existing or unset plane.
>
> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
> ---
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
--
Best regards,
Javier Martinez Canillas
Linux Engineering
Red Hat
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 4/4] drm/gem: Warn on trying to use a non-existing framebuffer plane
2022-05-09 8:15 [PATCH 0/4] drm: Ignore non-existing color planes in helpers Thomas Zimmermann
@ 2022-05-09 8:16 ` Thomas Zimmermann
2022-05-16 13:35 ` Javier Martinez Canillas
0 siblings, 1 reply; 3+ messages in thread
From: Thomas Zimmermann @ 2022-05-09 8:16 UTC (permalink / raw)
To: daniel, airlied, mripard, maarten.lankhorst, noralf, christian.koenig
Cc: Thomas Zimmermann, dri-devel
Warn if callers of drm_gem_fb_get_obj() try to use a GEM buffer for
a non-existing or unset plane.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/drm_gem_framebuffer_helper.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
index 09e90e19cd93..291f9ae4359d 100644
--- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c
+++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
@@ -53,7 +53,11 @@ MODULE_IMPORT_NS(DMA_BUF);
struct drm_gem_object *drm_gem_fb_get_obj(struct drm_framebuffer *fb,
unsigned int plane)
{
- if (plane >= ARRAY_SIZE(fb->obj))
+ struct drm_device *dev = fb->dev;
+
+ if (drm_WARN_ON_ONCE(dev, plane >= ARRAY_SIZE(fb->obj)))
+ return NULL;
+ else if (drm_WARN_ON_ONCE(dev, !fb->obj[plane]))
return NULL;
return fb->obj[plane];
--
2.36.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-05-16 13:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-13 13:35 [PATCH 4/4] drm/gem: Warn on trying to use a non-existing framebuffer plane kernel test robot
-- strict thread matches above, loose matches on Subject: below --
2022-05-09 8:15 [PATCH 0/4] drm: Ignore non-existing color planes in helpers Thomas Zimmermann
2022-05-09 8:16 ` [PATCH 4/4] drm/gem: Warn on trying to use a non-existing framebuffer plane Thomas Zimmermann
2022-05-16 13:35 ` Javier Martinez Canillas
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.