[PATCH] drm/kmb: fix array bounds warning

* [PATCH] drm/kmb: fix array bounds warning
@ 2020-11-29 20:09 Arnd Bergmann
  2020-11-30 22:19 ` Chrisanthus, Anitha
  0 siblings, 1 reply; 3+ messages in thread
From: Arnd Bergmann @ 2020-11-29 20:09 UTC (permalink / raw)
  To: Anitha Chrisanthus, Edmund Dea, David Airlie, Daniel Vetter,
	Sam Ravnborg
  Cc: Arnd Bergmann, kernel test robot, dri-devel, linux-kernel

From: Arnd Bergmann <arnd@arndb.de>

gcc warns about an out-of-bounds access when the using nonzero
values for 'plane_id' on kmb->plane_status:

drivers/gpu/drm/kmb/kmb_plane.c: In function 'kmb_plane_atomic_disable':
drivers/gpu/drm/kmb/kmb_plane.c:128:20: warning: array subscript 3 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
  128 |   kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL2_ENABLE;
      |   ~~~~~~~~~~~~~~~~~^~~~~~~~~~
drivers/gpu/drm/kmb/kmb_plane.c:125:20: warning: array subscript 2 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
  125 |   kmb->plane_status[plane_id].ctrl = LCD_CTRL_GL1_ENABLE;
      |   ~~~~~~~~~~~~~~~~~^~~~~~~~~~
drivers/gpu/drm/kmb/kmb_plane.c:122:20: warning: array subscript 1 is above array bounds of 'struct layer_status[1]' [-Warray-bounds]
  122 |   kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL2_ENABLE;

Having the array truncated to one entry seems intentional, so add
a range check before indexing it to make it clearer what is going
on and shut up the warning.

I received the warning from the kernel test robot after a private
patch that turns on Warray-bounds unconditionally.

Fixes: 7f7b96a8a0a1 ("drm/kmb: Add support for KeemBay Display")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 drivers/gpu/drm/kmb/kmb_plane.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/kmb/kmb_plane.c b/drivers/gpu/drm/kmb/kmb_plane.c
index 8448d1edb553..be8eea3830c1 100644
--- a/drivers/gpu/drm/kmb/kmb_plane.c
+++ b/drivers/gpu/drm/kmb/kmb_plane.c
@@ -114,6 +114,9 @@ static void kmb_plane_atomic_disable(struct drm_plane *plane,
 
 	kmb = to_kmb(plane->dev);
 
+	if (WARN_ON(plane_id >= KMB_MAX_PLANES))
+		return;
+
 	switch (plane_id) {
 	case LAYER_0:
 		kmb->plane_status[plane_id].ctrl = LCD_CTRL_VL1_ENABLE;
-- 
2.27.0


^ permalink raw reply related	[flat|nested] 3+ messages in thread