Patch "drm/imx: imx-ldb: fix out of bounds array access warning" has been added to the 5.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    drm/imx: imx-ldb: fix out of bounds array access warning

to the 5.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     drm-imx-imx-ldb-fix-out-of-bounds-array-access-warni.patch
and it can be found in the queue-5.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5ea832bef499ade2fc58dc6f7d1a9f699cf643be
Author: Arnd Bergmann <arnd@xxxxxxxx>
Date:   Wed Mar 24 17:47:41 2021 +0100

    drm/imx: imx-ldb: fix out of bounds array access warning
    
    [ Upstream commit 33ce7f2f95cabb5834cf0906308a5cb6103976da ]
    
    When CONFIG_OF is disabled, building with 'make W=1' produces warnings
    about out of bounds array access:
    
    drivers/gpu/drm/imx/imx-ldb.c: In function 'imx_ldb_set_clock.constprop':
    drivers/gpu/drm/imx/imx-ldb.c:186:8: error: array subscript -22 is below array bounds of 'struct clk *[4]' [-Werror=array-bounds]
    
    Add an error check before the index is used, which helps with the
    warning, as well as any possible other error condition that may be
    triggered at runtime.
    
    The warning could be fixed by adding a Kconfig depedency on CONFIG_OF,
    but Liu Ying points out that the driver may hit the out-of-bounds
    problem at runtime anyway.
    
    Signed-off-by: Arnd Bergmann <arnd@xxxxxxxx>
    Reviewed-by: Liu Ying <victor.liu@xxxxxxx>
    Signed-off-by: Philipp Zabel <p.zabel@xxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 41e2978cb1eb..75036aaa0c63 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -190,6 +190,11 @@ static void imx_ldb_encoder_enable(struct drm_encoder *encoder)
 	int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN;
 	int mux = drm_of_encoder_active_port_id(imx_ldb_ch->child, encoder);
 
+	if (mux < 0 || mux >= ARRAY_SIZE(ldb->clk_sel)) {
+		dev_warn(ldb->dev, "%s: invalid mux %d\n", __func__, mux);
+		return;
+	}
+
 	drm_panel_prepare(imx_ldb_ch->panel);
 
 	if (dual) {
@@ -248,6 +253,11 @@ imx_ldb_encoder_atomic_mode_set(struct drm_encoder *encoder,
 	int mux = drm_of_encoder_active_port_id(imx_ldb_ch->child, encoder);
 	u32 bus_format = imx_ldb_ch->bus_format;
 
+	if (mux < 0 || mux >= ARRAY_SIZE(ldb->clk_sel)) {
+		dev_warn(ldb->dev, "%s: invalid mux %d\n", __func__, mux);
+		return;
+	}
+
 	if (mode->clock > 170000) {
 		dev_warn(ldb->dev,
 			 "%s: mode exceeds 170 MHz pixel clock\n", __func__);