[bug report] drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem

[bug report] drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem

[dan.carpenter]

Hello Hyun Kwon,

The patch d76271d22694: "drm: xlnx: DRM/KMS driver for Xilinx ZynqMP
DisplayPort Subsystem" from Jul 7, 2018, leads to the following
static checker warning:

	drivers/gpu/drm/xlnx/zynqmp_dp.c:594 zynqmp_dp_mode_configure()
	error: iterator underflow 'bws' (-1)-2

drivers/gpu/drm/xlnx/zynqmp_dp.c
   566  static int zynqmp_dp_mode_configure(struct zynqmp_dp *dp, int pclock,
   567                                      u8 current_bw)
   568  {
   569          int max_rate = dp->link_config.max_rate;
   570          u8 bws[3] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7, DP_LINK_BW_5_4 };
   571          u8 max_lanes = dp->link_config.max_lanes;
   572          u8 max_link_rate_code = drm_dp_link_rate_to_bw_code(max_rate);
   573          u8 bpp = dp->config.bpp;
   574          u8 lane_cnt;
   575          s8 i;
   576  
   577          if (current_bw == DP_LINK_BW_1_62) {
   578                  dev_err(dp->dev, "can't downshift. already lowest link rate\n");
   579                  return -EINVAL;
   580          }
   581  
   582          for (i = ARRAY_SIZE(bws) - 1; i >= 0; i--) {
                                              ^^^^^^
This exits with i == -1.

   583                  if (current_bw && bws[i] >= current_bw)
   584                          continue;
   585  
   586                  if (bws[i] <= max_link_rate_code)
   587                          break;
   588          }
   589  
   590          for (lane_cnt = 1; lane_cnt <= max_lanes; lane_cnt <<= 1) {
   591                  int bw;
   592                  u32 rate;
   593  
   594                  bw = drm_dp_bw_code_to_link_rate(bws[i]);
                                                         ^^^^^^
Potential negative array offset.

   595                  rate = zynqmp_dp_max_rate(bw, lane_cnt, bpp);
   596                  if (pclock <= rate) {
   597                          dp->mode.bw_code = bws[i];
   598                          dp->mode.lane_cnt = lane_cnt;
   599                          dp->mode.pclock = pclock;
   600                          return dp->mode.bw_code;
   601                  }
   602          }
   603  
   604          dev_err(dp->dev, "failed to configure link values\n");
   605  
   606          return -EINVAL;
   607  }

regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [bug report] drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem

[Hyun Kwon]

Hi Dan,

Thanks for sharing.

On Mon, Jul 27, 2020 at 04:18:25AM -0700, dan.carpenter@oracle.com wrote:
> Hello Hyun Kwon,
> 
> The patch d76271d22694: "drm: xlnx: DRM/KMS driver for Xilinx ZynqMP
> DisplayPort Subsystem" from Jul 7, 2018, leads to the following
> static checker warning:
> 
> 	drivers/gpu/drm/xlnx/zynqmp_dp.c:594 zynqmp_dp_mode_configure()
> 	error: iterator underflow 'bws' (-1)-2
> 
> drivers/gpu/drm/xlnx/zynqmp_dp.c
>    566  static int zynqmp_dp_mode_configure(struct zynqmp_dp *dp, int pclock,
>    567                                      u8 current_bw)
>    568  {
>    569          int max_rate = dp->link_config.max_rate;
>    570          u8 bws[3] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7, DP_LINK_BW_5_4 };
>    571          u8 max_lanes = dp->link_config.max_lanes;
>    572          u8 max_link_rate_code = drm_dp_link_rate_to_bw_code(max_rate);
>    573          u8 bpp = dp->config.bpp;
>    574          u8 lane_cnt;
>    575          s8 i;
>    576  
>    577          if (current_bw == DP_LINK_BW_1_62) {
>    578                  dev_err(dp->dev, "can't downshift. already lowest link rate\n");
>    579                  return -EINVAL;
>    580          }

There are checks like this that ensure the 'i' to be not negative, but I agree
it should be made clearer. I've sumitted a fix for it [1].

[1] https://lists.freedesktop.org/archives/dri-devel/2020-July/274190.html

Thanks,
-hyun

>    581  
>    582          for (i = ARRAY_SIZE(bws) - 1; i >= 0; i--) {
>                                               ^^^^^^
> This exits with i == -1.
> 
>    583                  if (current_bw && bws[i] >= current_bw)
>    584                          continue;
>    585  
>    586                  if (bws[i] <= max_link_rate_code)
>    587                          break;
>    588          }
>    589  
>    590          for (lane_cnt = 1; lane_cnt <= max_lanes; lane_cnt <<= 1) {
>    591                  int bw;
>    592                  u32 rate;
>    593  
>    594                  bw = drm_dp_bw_code_to_link_rate(bws[i]);
>                                                          ^^^^^^
> Potential negative array offset.
> 
>    595                  rate = zynqmp_dp_max_rate(bw, lane_cnt, bpp);
>    596                  if (pclock <= rate) {
>    597                          dp->mode.bw_code = bws[i];
>    598                          dp->mode.lane_cnt = lane_cnt;
>    599                          dp->mode.pclock = pclock;
>    600                          return dp->mode.bw_code;
>    601                  }
>    602          }
>    603  
>    604          dev_err(dp->dev, "failed to configure link values\n");
>    605  
>    606          return -EINVAL;
>    607  }
> 
> regards,
> dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel