linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] drm/amd/display: fix array-bounds error in dc_stream_remove_writeback()
@ 2022-11-08 10:55 wangkailong
  0 siblings, 0 replies; 8+ messages in thread
From: wangkailong @ 2022-11-08 10:55 UTC (permalink / raw)
  To: Wentland, Li, Siqueira, Deucher, Christian König, Pan,
	Xinhui, Airlie, Vetter
  Cc: amd-gfx, dri-devel, linux-kernel

replace the subsequent check for 'i != j' with 
Delete header file "timing_generator.h"

Signed-off-by: KaiLong Wang <wangkailong@jari.cn>
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 38d71b5c1f2d..66661a20117b 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -29,7 +29,6 @@
 #include "core_types.h"
 #include "resource.h"
 #include "ipp.h"
-#include "timing_generator.h"
 #include "dc_dmub_srv.h"
 
 #define DC_LOGGER dc->ctx->logger
@@ -152,9 +151,8 @@ static void dc_stream_free(struct kref *kref)
 
 void dc_stream_release(struct dc_stream_state *stream)
 {
-	if (stream != NULL) {
+	if (stream != NULL)
 		kref_put(&stream->refcount, dc_stream_free);
-	}
 }
 
 struct dc_stream_state *dc_create_stream_for_sink(
@@ -316,11 +314,11 @@ bool dc_stream_set_cursor_attributes(
 	struct dc  *dc;
 	bool reset_idle_optimizations = false;
 
-	if (NULL == stream) {
+	if (stream == NULL) {
 		dm_error("DC: dc_stream is NULL!\n");
 		return false;
 	}
-	if (NULL == attributes) {
+	if (attributes == NULL) {
 		dm_error("DC: attributes is NULL!\n");
 		return false;
 	}
@@ -399,12 +397,12 @@ bool dc_stream_set_cursor_position(
 	struct dc  *dc = stream->ctx->dc;
 	bool reset_idle_optimizations = false;
 
-	if (NULL == stream) {
+	if (stream == NULL) {
 		dm_error("DC: dc_stream is NULL!\n");
 		return false;
 	}
 
-	if (NULL == position) {
+	if (position == NULL) {
 		dm_error("DC: cursor position is NULL!\n");
 		return false;
 	}
@@ -468,9 +466,8 @@ bool dc_stream_add_writeback(struct dc *dc,
 		}
 	}
 
-	if (!isDrc) {
+	if (!isDrc)
 		stream->writeback_info[stream->num_wb_info++] = *wb_info;
-	}
 
 	if (dc->hwss.enable_writeback) {
 		struct dc_stream_status *stream_status = dc_stream_get_status(stream);
@@ -526,7 +523,7 @@ bool dc_stream_remove_writeback(struct dc *dc,
 	/* remove writeback info for disabled writeback pipes from stream */
 	for (i = 0, j = 0; i < stream->num_wb_info; i++) {
 		if (stream->writeback_info[i].wb_enabled) {
-			if (j < i)
+			if (i != j)
 				/* trim the array */
 				stream->writeback_info[j] = stream->writeback_info[i];
 			j++;
-- 
2.36.1


^ permalink raw reply related	[flat|nested] 8+ messages in thread
* [PATCH] drm/amd/display: fix array-bounds error in dc_stream_remove_writeback()
@ 2022-09-27 19:12 Hamza Mahfooz
       [not found] ` <CH0PR12MB5284EAC9E9D095B2624631228B559@CH0PR12MB5284.namprd12.prod.outlook.com>
  2022-10-06  6:46 ` Guenter Roeck
  0 siblings, 2 replies; 8+ messages in thread
From: Hamza Mahfooz @ 2022-09-27 19:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Hamza Mahfooz, Harry Wentland, Leo Li, Rodrigo Siqueira,
	Alex Deucher, Christian König, Pan, Xinhui, David Airlie,
	Daniel Vetter, Lee, Alvin, Alex Hung, Pavle Kotarac, Stylon Wang,
	Aurabindo Pillai, Leo (Hanghong) Ma, Hersen Wu, Paul Hsieh,
	Jimmy Kizito, amd-gfx, dri-devel

Address the following error:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ‘dc_stream_remove_writeback’:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:527:55: error: array subscript [0, 0] is outside array bounds of ‘struct dc_writeback_info[1]’ [-Werror=array-bounds]
  527 |                                 stream->writeback_info[j] = stream->writeback_info[i];
      |                                 ~~~~~~~~~~~~~~~~~~~~~~^~~
In file included from ./drivers/gpu/drm/amd/amdgpu/../display/dc/dc.h:1269,
                 from ./drivers/gpu/drm/amd/amdgpu/../display/dc/inc/core_types.h:29,
                 from ./drivers/gpu/drm/amd/amdgpu/../display/dc/basics/dc_common.h:29,
                 from drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:27:
./drivers/gpu/drm/amd/amdgpu/../display/dc/dc_stream.h:241:34: note: while referencing ‘writeback_info’
  241 |         struct dc_writeback_info writeback_info[MAX_DWB_PIPES];
      |

Currently, we aren't checking to see if j remains within
writeback_info[]'s bounds. So, add a check to make sure that we aren't
overflowing the buffer.

Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
---
 drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
index 3ca1592ce7ac..ae13887756bf 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -520,7 +520,7 @@ bool dc_stream_remove_writeback(struct dc *dc,
 	}
 
 	/* remove writeback info for disabled writeback pipes from stream */
-	for (i = 0, j = 0; i < stream->num_wb_info; i++) {
+	for (i = 0, j = 0; i < stream->num_wb_info && j < MAX_DWB_PIPES; i++) {
 		if (stream->writeback_info[i].wb_enabled) {
 			if (i != j)
 				/* trim the array */
-- 
2.37.2


^ permalink raw reply related	[flat|nested] 8+ messages in thread
end of thread, other threads:[~2022-11-08 11:00 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-11-08 10:55 [PATCH] drm/amd/display: fix array-bounds error in dc_stream_remove_writeback() wangkailong
  -- strict thread matches above, loose matches on Subject: below --
2022-09-27 19:12 Hamza Mahfooz
     [not found] ` <CH0PR12MB5284EAC9E9D095B2624631228B559@CH0PR12MB5284.namprd12.prod.outlook.com>
2022-09-29 15:36   ` Felix Kuehling
2022-09-29 15:41     ` Hamza Mahfooz
2022-09-29 16:05       ` Felix Kuehling
2022-10-06  6:46 ` Guenter Roeck
2022-10-06 17:23   ` Guenter Roeck
2022-10-11  9:49     ` Thorsten Leemhuis

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).