All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/amd/display: fix array-bounds errors in dc_stream_remove_writeback()
@ 2022-12-25 15:10 ` wenyang.linux
  0 siblings, 0 replies; 6+ messages in thread
From: wenyang.linux @ 2022-12-25 15:10 UTC (permalink / raw)
  To: Alex Deucher, Hamza Mahfooz, Aurabindo Pillai
  Cc: Wen Yang, Guenter Roeck, Harry Wentland ,
	Leo Li ,
	amd-gfx, dri-devel, linux-kernel

From: Wen Yang <wenyang.linux@foxmail.com>

The following errors occurred when using gcc 7.5.0-3ubuntu1~18.04:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ‘dc_stream_remove_writeback’:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:543:55: warning: array subscript is above array bounds [-Warray-bounds]
     stream->writeback_info[j] = stream->writeback_info[i];
                                 ~~~~~~~~~~~~~~~~~~~~~~^~~
Add a check to make sure that num_wb_info won't overflowing the writeback_info buffer.

Fixes: 6fbefb84a98e ("drm/amd/display: Add DC core changes for DCN2")

Signed-off-by: Wen Yang <wenyang.linux@foxmail.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Leo Li <sunpeng.li@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 20e534f73513..9825c30f2ca0 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -481,6 +481,7 @@ bool dc_stream_add_writeback(struct dc *dc,
 	}
 
 	if (!isDrc) {
+		ASSERT(stream->num_wb_info + 1 <= MAX_DWB_PIPES);
 		stream->writeback_info[stream->num_wb_info++] = *wb_info;
 	}
 
@@ -526,6 +527,11 @@ bool dc_stream_remove_writeback(struct dc *dc,
 		return false;
 	}
 
+	if (stream->num_wb_info > MAX_DWB_PIPES) {
+		dm_error("DC: num_wb_info is invalid!\n");
+		return false;
+	}
+
 //	stream->writeback_info[dwb_pipe_inst].wb_enabled = false;
 	for (i = 0; i < stream->num_wb_info; i++) {
 		/*dynamic update*/
@@ -540,7 +546,8 @@ bool dc_stream_remove_writeback(struct dc *dc,
 		if (stream->writeback_info[i].wb_enabled) {
 			if (j < i)
 				/* trim the array */
-				stream->writeback_info[j] = stream->writeback_info[i];
+				memcpy(&stream->writeback_info[j], &stream->writeback_info[i],
+						sizeof(struct dc_writeback_info));
 			j++;
 		}
 	}
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH] drm/amd/display: fix array-bounds errors in dc_stream_remove_writeback()
@ 2022-12-25 15:10 ` wenyang.linux
  0 siblings, 0 replies; 6+ messages in thread
From: wenyang.linux @ 2022-12-25 15:10 UTC (permalink / raw)
  To: Alex Deucher, Hamza Mahfooz, Aurabindo Pillai
  Cc: Wen Yang, Leo Li ,
	linux-kernel, dri-devel, amd-gfx, Guenter Roeck

From: Wen Yang <wenyang.linux@foxmail.com>

The following errors occurred when using gcc 7.5.0-3ubuntu1~18.04:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ‘dc_stream_remove_writeback’:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:543:55: warning: array subscript is above array bounds [-Warray-bounds]
     stream->writeback_info[j] = stream->writeback_info[i];
                                 ~~~~~~~~~~~~~~~~~~~~~~^~~
Add a check to make sure that num_wb_info won't overflowing the writeback_info buffer.

Fixes: 6fbefb84a98e ("drm/amd/display: Add DC core changes for DCN2")

Signed-off-by: Wen Yang <wenyang.linux@foxmail.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Leo Li <sunpeng.li@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 20e534f73513..9825c30f2ca0 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -481,6 +481,7 @@ bool dc_stream_add_writeback(struct dc *dc,
 	}
 
 	if (!isDrc) {
+		ASSERT(stream->num_wb_info + 1 <= MAX_DWB_PIPES);
 		stream->writeback_info[stream->num_wb_info++] = *wb_info;
 	}
 
@@ -526,6 +527,11 @@ bool dc_stream_remove_writeback(struct dc *dc,
 		return false;
 	}
 
+	if (stream->num_wb_info > MAX_DWB_PIPES) {
+		dm_error("DC: num_wb_info is invalid!\n");
+		return false;
+	}
+
 //	stream->writeback_info[dwb_pipe_inst].wb_enabled = false;
 	for (i = 0; i < stream->num_wb_info; i++) {
 		/*dynamic update*/
@@ -540,7 +546,8 @@ bool dc_stream_remove_writeback(struct dc *dc,
 		if (stream->writeback_info[i].wb_enabled) {
 			if (j < i)
 				/* trim the array */
-				stream->writeback_info[j] = stream->writeback_info[i];
+				memcpy(&stream->writeback_info[j], &stream->writeback_info[i],
+						sizeof(struct dc_writeback_info));
 			j++;
 		}
 	}
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH] drm/amd/display: fix array-bounds errors in dc_stream_remove_writeback()
@ 2022-12-25 15:10 ` wenyang.linux
  0 siblings, 0 replies; 6+ messages in thread
From: wenyang.linux @ 2022-12-25 15:10 UTC (permalink / raw)
  To: Alex Deucher, Hamza Mahfooz, Aurabindo Pillai
  Cc: Wen Yang, Leo Li ,
	linux-kernel, dri-devel, amd-gfx, Harry Wentland ,
	Guenter Roeck

From: Wen Yang <wenyang.linux@foxmail.com>

The following errors occurred when using gcc 7.5.0-3ubuntu1~18.04:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ‘dc_stream_remove_writeback’:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:543:55: warning: array subscript is above array bounds [-Warray-bounds]
     stream->writeback_info[j] = stream->writeback_info[i];
                                 ~~~~~~~~~~~~~~~~~~~~~~^~~
Add a check to make sure that num_wb_info won't overflowing the writeback_info buffer.

Fixes: 6fbefb84a98e ("drm/amd/display: Add DC core changes for DCN2")

Signed-off-by: Wen Yang <wenyang.linux@foxmail.com>
Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Leo Li <sunpeng.li@amd.com>
Cc: amd-gfx@lists.freedesktop.org
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 20e534f73513..9825c30f2ca0 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -481,6 +481,7 @@ bool dc_stream_add_writeback(struct dc *dc,
 	}
 
 	if (!isDrc) {
+		ASSERT(stream->num_wb_info + 1 <= MAX_DWB_PIPES);
 		stream->writeback_info[stream->num_wb_info++] = *wb_info;
 	}
 
@@ -526,6 +527,11 @@ bool dc_stream_remove_writeback(struct dc *dc,
 		return false;
 	}
 
+	if (stream->num_wb_info > MAX_DWB_PIPES) {
+		dm_error("DC: num_wb_info is invalid!\n");
+		return false;
+	}
+
 //	stream->writeback_info[dwb_pipe_inst].wb_enabled = false;
 	for (i = 0; i < stream->num_wb_info; i++) {
 		/*dynamic update*/
@@ -540,7 +546,8 @@ bool dc_stream_remove_writeback(struct dc *dc,
 		if (stream->writeback_info[i].wb_enabled) {
 			if (j < i)
 				/* trim the array */
-				stream->writeback_info[j] = stream->writeback_info[i];
+				memcpy(&stream->writeback_info[j], &stream->writeback_info[i],
+						sizeof(struct dc_writeback_info));
 			j++;
 		}
 	}
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH] drm/amd/display: fix array-bounds errors in dc_stream_remove_writeback()
  2022-12-25 15:10 ` wenyang.linux
  (?)
@ 2023-01-04 22:22   ` Hamza Mahfooz
  -1 siblings, 0 replies; 6+ messages in thread
From: Hamza Mahfooz @ 2023-01-04 22:22 UTC (permalink / raw)
  To: wenyang.linux, Alex Deucher, Aurabindo Pillai
  Cc: Leo Li, linux-kernel, dri-devel, amd-gfx, Guenter Roeck

On 12/25/22 10:10, wenyang.linux@foxmail.com wrote:
> From: Wen Yang <wenyang.linux@foxmail.com>
> 
> The following errors occurred when using gcc 7.5.0-3ubuntu1~18.04:
> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ‘dc_stream_remove_writeback’:
> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:543:55: warning: array subscript is above array bounds [-Warray-bounds]
>       stream->writeback_info[j] = stream->writeback_info[i];
>                                   ~~~~~~~~~~~~~~~~~~~~~~^~~
> Add a check to make sure that num_wb_info won't overflowing the writeback_info buffer.
> 
> Fixes: 6fbefb84a98e ("drm/amd/display: Add DC core changes for DCN2")
> 
> Signed-off-by: Wen Yang <wenyang.linux@foxmail.com>
> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
> Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Harry Wentland <harry.wentland@amd.com>
> Cc: Leo Li <sunpeng.li@amd.com>
> Cc: amd-gfx@lists.freedesktop.org
> Cc: dri-devel@lists.freedesktop.org
> Cc: linux-kernel@vger.kernel.org

Applied, thanks!

> ---
>   drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 9 ++++++++-
>   1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> index 20e534f73513..9825c30f2ca0 100644
> --- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> +++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> @@ -481,6 +481,7 @@ bool dc_stream_add_writeback(struct dc *dc,
>   	}
>   
>   	if (!isDrc) {
> +		ASSERT(stream->num_wb_info + 1 <= MAX_DWB_PIPES);
>   		stream->writeback_info[stream->num_wb_info++] = *wb_info;
>   	}
>   
> @@ -526,6 +527,11 @@ bool dc_stream_remove_writeback(struct dc *dc,
>   		return false;
>   	}
>   
> +	if (stream->num_wb_info > MAX_DWB_PIPES) {
> +		dm_error("DC: num_wb_info is invalid!\n");
> +		return false;
> +	}
> +
>   //	stream->writeback_info[dwb_pipe_inst].wb_enabled = false;
>   	for (i = 0; i < stream->num_wb_info; i++) {
>   		/*dynamic update*/
> @@ -540,7 +546,8 @@ bool dc_stream_remove_writeback(struct dc *dc,
>   		if (stream->writeback_info[i].wb_enabled) {
>   			if (j < i)
>   				/* trim the array */
> -				stream->writeback_info[j] = stream->writeback_info[i];
> +				memcpy(&stream->writeback_info[j], &stream->writeback_info[i],
> +						sizeof(struct dc_writeback_info));
>   			j++;
>   		}
>   	}

-- 
Hamza


^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] drm/amd/display: fix array-bounds errors in dc_stream_remove_writeback()
@ 2023-01-04 22:22   ` Hamza Mahfooz
  0 siblings, 0 replies; 6+ messages in thread
From: Hamza Mahfooz @ 2023-01-04 22:22 UTC (permalink / raw)
  To: wenyang.linux, Alex Deucher, Aurabindo Pillai
  Cc: Leo Li, linux-kernel, dri-devel, amd-gfx, Harry Wentland, Guenter Roeck

On 12/25/22 10:10, wenyang.linux@foxmail.com wrote:
> From: Wen Yang <wenyang.linux@foxmail.com>
> 
> The following errors occurred when using gcc 7.5.0-3ubuntu1~18.04:
> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ‘dc_stream_remove_writeback’:
> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:543:55: warning: array subscript is above array bounds [-Warray-bounds]
>       stream->writeback_info[j] = stream->writeback_info[i];
>                                   ~~~~~~~~~~~~~~~~~~~~~~^~~
> Add a check to make sure that num_wb_info won't overflowing the writeback_info buffer.
> 
> Fixes: 6fbefb84a98e ("drm/amd/display: Add DC core changes for DCN2")
> 
> Signed-off-by: Wen Yang <wenyang.linux@foxmail.com>
> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
> Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Harry Wentland <harry.wentland@amd.com>
> Cc: Leo Li <sunpeng.li@amd.com>
> Cc: amd-gfx@lists.freedesktop.org
> Cc: dri-devel@lists.freedesktop.org
> Cc: linux-kernel@vger.kernel.org

Applied, thanks!

> ---
>   drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 9 ++++++++-
>   1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> index 20e534f73513..9825c30f2ca0 100644
> --- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> +++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> @@ -481,6 +481,7 @@ bool dc_stream_add_writeback(struct dc *dc,
>   	}
>   
>   	if (!isDrc) {
> +		ASSERT(stream->num_wb_info + 1 <= MAX_DWB_PIPES);
>   		stream->writeback_info[stream->num_wb_info++] = *wb_info;
>   	}
>   
> @@ -526,6 +527,11 @@ bool dc_stream_remove_writeback(struct dc *dc,
>   		return false;
>   	}
>   
> +	if (stream->num_wb_info > MAX_DWB_PIPES) {
> +		dm_error("DC: num_wb_info is invalid!\n");
> +		return false;
> +	}
> +
>   //	stream->writeback_info[dwb_pipe_inst].wb_enabled = false;
>   	for (i = 0; i < stream->num_wb_info; i++) {
>   		/*dynamic update*/
> @@ -540,7 +546,8 @@ bool dc_stream_remove_writeback(struct dc *dc,
>   		if (stream->writeback_info[i].wb_enabled) {
>   			if (j < i)
>   				/* trim the array */
> -				stream->writeback_info[j] = stream->writeback_info[i];
> +				memcpy(&stream->writeback_info[j], &stream->writeback_info[i],
> +						sizeof(struct dc_writeback_info));
>   			j++;
>   		}
>   	}

-- 
Hamza


^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] drm/amd/display: fix array-bounds errors in dc_stream_remove_writeback()
@ 2023-01-04 22:22   ` Hamza Mahfooz
  0 siblings, 0 replies; 6+ messages in thread
From: Hamza Mahfooz @ 2023-01-04 22:22 UTC (permalink / raw)
  To: wenyang.linux, Alex Deucher, Aurabindo Pillai
  Cc: Guenter Roeck, Harry Wentland, Leo Li, amd-gfx, dri-devel, linux-kernel

On 12/25/22 10:10, wenyang.linux@foxmail.com wrote:
> From: Wen Yang <wenyang.linux@foxmail.com>
> 
> The following errors occurred when using gcc 7.5.0-3ubuntu1~18.04:
> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ‘dc_stream_remove_writeback’:
> drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:543:55: warning: array subscript is above array bounds [-Warray-bounds]
>       stream->writeback_info[j] = stream->writeback_info[i];
>                                   ~~~~~~~~~~~~~~~~~~~~~~^~~
> Add a check to make sure that num_wb_info won't overflowing the writeback_info buffer.
> 
> Fixes: 6fbefb84a98e ("drm/amd/display: Add DC core changes for DCN2")
> 
> Signed-off-by: Wen Yang <wenyang.linux@foxmail.com>
> Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
> Cc: Hamza Mahfooz <hamza.mahfooz@amd.com>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Cc: Harry Wentland <harry.wentland@amd.com>
> Cc: Leo Li <sunpeng.li@amd.com>
> Cc: amd-gfx@lists.freedesktop.org
> Cc: dri-devel@lists.freedesktop.org
> Cc: linux-kernel@vger.kernel.org

Applied, thanks!

> ---
>   drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 9 ++++++++-
>   1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> index 20e534f73513..9825c30f2ca0 100644
> --- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> +++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> @@ -481,6 +481,7 @@ bool dc_stream_add_writeback(struct dc *dc,
>   	}
>   
>   	if (!isDrc) {
> +		ASSERT(stream->num_wb_info + 1 <= MAX_DWB_PIPES);
>   		stream->writeback_info[stream->num_wb_info++] = *wb_info;
>   	}
>   
> @@ -526,6 +527,11 @@ bool dc_stream_remove_writeback(struct dc *dc,
>   		return false;
>   	}
>   
> +	if (stream->num_wb_info > MAX_DWB_PIPES) {
> +		dm_error("DC: num_wb_info is invalid!\n");
> +		return false;
> +	}
> +
>   //	stream->writeback_info[dwb_pipe_inst].wb_enabled = false;
>   	for (i = 0; i < stream->num_wb_info; i++) {
>   		/*dynamic update*/
> @@ -540,7 +546,8 @@ bool dc_stream_remove_writeback(struct dc *dc,
>   		if (stream->writeback_info[i].wb_enabled) {
>   			if (j < i)
>   				/* trim the array */
> -				stream->writeback_info[j] = stream->writeback_info[i];
> +				memcpy(&stream->writeback_info[j], &stream->writeback_info[i],
> +						sizeof(struct dc_writeback_info));
>   			j++;
>   		}
>   	}

-- 
Hamza


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-01-04 22:22 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-25 15:10 [PATCH] drm/amd/display: fix array-bounds errors in dc_stream_remove_writeback() wenyang.linux
2022-12-25 15:10 ` wenyang.linux
2022-12-25 15:10 ` wenyang.linux
2023-01-04 22:22 ` Hamza Mahfooz
2023-01-04 22:22   ` Hamza Mahfooz
2023-01-04 22:22   ` Hamza Mahfooz

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.