Re: [PATCH] drm/amd/display: fix array-bounds error in dc_stream_remove_writeback()

[Felix Kuehling <felix.kuehling@xxxxxxx>]

Am 2022-09-29 um 11:41 schrieb Hamza Mahfooz:
> On 2022-09-29 11:36, Felix Kuehling wrote:
> > I'm still seeing a warning even with this fix:
> >
> > /home/fkuehlin/compute/kernel/drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: 
> > In function ?dc_stream_remove_writeback?:
> > /home/fkuehlin/compute/kernel/drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:527:55: 
> > warning: array subscript 1 is above array bounds of ?struct 
> > dc_writeback_info[1]? [-Warray-bounds]
> >    527 |     stream->writeback_info[j] = stream->writeback_info[i];
> >        | ~~~~~~~~~~~~~~~~~~~~~~^~~
>
> What version of GCC are you using? I don't see it on GCC 12.2 with 
> this patch applied.

gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0

Regards,
  Felix


> > Regards,
> >    Felix
> >
> >
> > Am 2022-09-27 um 16:35 schrieb Pillai, Aurabindo:
> > > [AMD Official Use Only - General]
> > >
> > >
> > > [AMD Official Use Only - General]
> > >
> > >
> > > Reviewed-by: Aurabindo Pillai <aurabindo.pillai@xxxxxxx>
> > >
> > > --
> > >
> > > Regards,
> > > Jay
> > > ------------------------------------------------------------------------ 
> > >
> > > *From:* Mahfooz, Hamza <Hamza.Mahfooz@xxxxxxx>
> > > *Sent:* Tuesday, September 27, 2022 3:12 PM
> > > *To:* linux-kernel@xxxxxxxxxxxxxxx <linux-kernel@xxxxxxxxxxxxxxx>
> > > *Cc:* Mahfooz, Hamza <Hamza.Mahfooz@xxxxxxx>; Wentland, Harry 
> > > <Harry.Wentland@xxxxxxx>; Li, Sun peng (Leo) <Sunpeng.Li@xxxxxxx>; 
> > > Siqueira, Rodrigo <Rodrigo.Siqueira@xxxxxxx>; Deucher, Alexander 
> > > <Alexander.Deucher@xxxxxxx>; Koenig, Christian 
> > > <Christian.Koenig@xxxxxxx>; Pan, Xinhui <Xinhui.Pan@xxxxxxx>; David 
> > > Airlie <airlied@xxxxxxxx>; Daniel Vetter <daniel@xxxxxxxx>; Lee, 
> > > Alvin <Alvin.Lee2@xxxxxxx>; Hung, Alex <Alex.Hung@xxxxxxx>; Kotarac, 
> > > Pavle <Pavle.Kotarac@xxxxxxx>; Wang, Chao-kai (Stylon) 
> > > <Stylon.Wang@xxxxxxx>; Pillai, Aurabindo <Aurabindo.Pillai@xxxxxxx>; 
> > > Ma, Leo <Hanghong.Ma@xxxxxxx>; Wu, Hersen <hersenxs.wu@xxxxxxx>; 
> > > Po-Yu Hsieh Paul <Paul.Hsieh@xxxxxxx>; Jimmy Kizito 
> > > <Jimmy.Kizito@xxxxxxx>; amd-gfx@xxxxxxxxxxxxxxxxxxxxx 
> > > <amd-gfx@xxxxxxxxxxxxxxxxxxxxx>; dri-devel@xxxxxxxxxxxxxxxxxxxxx 
> > > <dri-devel@xxxxxxxxxxxxxxxxxxxxx>
> > > *Subject:* [PATCH] drm/amd/display: fix array-bounds error in 
> > > dc_stream_remove_writeback()
> > > Address the following error:
> > > drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In 
> > > function ‘dc_stream_remove_writeback’:
> > > drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:527:55: 
> > > error: array subscript [0, 0] is outside array bounds of ‘struct 
> > > dc_writeback_info[1]’ [-Werror=array-bounds]
> > >   527 | stream->writeback_info[j] = stream->writeback_info[i];
> > >       | ~~~~~~~~~~~~~~~~~~~~~~^~~
> > > In file included from 
> > > ./drivers/gpu/drm/amd/amdgpu/../display/dc/dc.h:1269,
> > >                  from 
> > > ./drivers/gpu/drm/amd/amdgpu/../display/dc/inc/core_types.h:29,
> > >                  from 
> > > ./drivers/gpu/drm/amd/amdgpu/../display/dc/basics/dc_common.h:29,
> > >                  from 
> > > drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:27:
> > > ./drivers/gpu/drm/amd/amdgpu/../display/dc/dc_stream.h:241:34: note: 
> > > while referencing ‘writeback_info’
> > >   241 |         struct dc_writeback_info writeback_info[MAX_DWB_PIPES];
> > >       |
> > >
> > > Currently, we aren't checking to see if j remains within
> > > writeback_info[]'s bounds. So, add a check to make sure that we aren't
> > > overflowing the buffer.
> > >
> > > Signed-off-by: Hamza Mahfooz <hamza.mahfooz@xxxxxxx>
> > > ---
> > >  drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c 
> > > b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> > > index 3ca1592ce7ac..ae13887756bf 100644
> > > --- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> > > +++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
> > > @@ -520,7 +520,7 @@ bool dc_stream_remove_writeback(struct dc *dc,
> > >          }
> > >
> > >          /* remove writeback info for disabled writeback pipes from 
> > > stream */
> > > -       for (i = 0, j = 0; i < stream->num_wb_info; i++) {
> > > +       for (i = 0, j = 0; i < stream->num_wb_info && j < 
> > > MAX_DWB_PIPES; i++) {
> > >                  if (stream->writeback_info[i].wb_enabled) {
> > >                          if (i != j)
> > >                                  /* trim the array */
> > > --
> > > 2.37.2