Hello Thomas Hellstrom,
The patch d80efd5cb3de: "drm/vmwgfx: Initial DX support" from Aug 10,
2015, leads to the following static checker warning:
drivers/gpu/drm/vmwgfx/vmwgfx_so.c:335 vmw_view_add()
error: buffer overflow 'vmw_view_define_sizes' 3 <= 3
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
2656 static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv,
2657 struct vmw_sw_context *sw_context,
2658 SVGA3dCmdHeader *header)
2659 {
2660 struct vmw_resource_val_node *ctx_node = sw_context->dx_ctx_node;
2661 struct vmw_resource_val_node *srf_node;
2662 struct vmw_resource *res;
2663 enum vmw_view_type view_type;
2664 int ret;
2665 /*
2666 * This is based on the fact that all affected define commands have
2667 * the same initial command body layout.
2668 */
2669 struct {
2670 SVGA3dCmdHeader header;
2671 uint32 defined_id;
2672 uint32 sid;
2673 } *cmd;
2674
2675 if (unlikely(ctx_node == NULL)) {
2676 DRM_ERROR("DX Context not set.\n");
2677 return -EINVAL;
2678 }
2679
2680 view_type = vmw_view_cmd_to_type(header->id);
vmw_view_cmd_to_type() returns 0-3.
2681 cmd = container_of(header, typeof(*cmd), header);
2682 ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
2683 user_surface_converter,
2684 &cmd->sid, &srf_node);
2685 if (unlikely(ret != 0))
2686 return ret;
2687
2688 res = vmw_context_cotable(ctx_node->res, vmw_view_cotables[view_type]);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
So we're one space beyond the end of the array, here and other places.
2689 ret = vmw_cotable_notify(res, cmd->defined_id);
2690 vmw_resource_unreference(&res);
2691 if (unlikely(ret != 0))
2692 return ret;
regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel
