LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: kbuild@01.org, Jani Nikula <jani.nikula@intel.com>
Cc: kbuild-all@01.org, linux-kernel@vger.kernel.org,
	Chris Wilson <chris@chris-wilson.co.uk>
Subject: drivers/gpu/drm/i915/display/intel_display.c:3934 skl_plane_stride() error: testing array offset 'color_plane' after use.
Date: Sat, 14 Sep 2019 07:08:58 +0300
Message-ID: <20190914040858.GT20699@kadam> (raw)

tree:   https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   a7f89616b7376495424f682b6086e0c391a89a1d
commit: df0566a641f959108c152be748a0a58794280e0e drm/i915: move modesetting core code under display/
date:   3 months ago

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

New smatch warnings:
drivers/gpu/drm/i915/display/intel_display.c:3934 skl_plane_stride() error: testing array offset 'color_plane' after use.
drivers/gpu/drm/i915/display/intel_display.c:16328 intel_sanitize_encoder() error: we previously assumed 'crtc' could be null (see line 16318)

git remote add linus https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux.git
git remote update linus
git checkout df0566a641f959108c152be748a0a58794280e0e
vim +/color_plane +3934 drivers/gpu/drm/i915/display/intel_display.c

b3cf5c06ca5001 drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2018-09-25  3926  
df79cf44191029 drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2018-09-11  3927  u32 skl_plane_stride(const struct intel_plane_state *plane_state,
5d2a19507cb665 drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2018-09-07  3928  		     int color_plane)
d21967740f4b7d drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2016-01-28  3929  {
df79cf44191029 drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2018-09-11  3930  	const struct drm_framebuffer *fb = plane_state->base.fb;
df79cf44191029 drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2018-09-11  3931  	unsigned int rotation = plane_state->base.rotation;
5d2a19507cb665 drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2018-09-07  3932  	u32 stride = plane_state->color_plane[color_plane].stride;
                                                                                                                              ^^^^^^^^^^^
Out of bounds read?

1b500535c513ac drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2017-03-07  3933  
5d2a19507cb665 drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2018-09-07 @3934  	if (color_plane >= fb->format->num_planes)
                                                                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Tested too late.

1b500535c513ac drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2017-03-07  3935  		return 0;
1b500535c513ac drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2017-03-07  3936  
b3cf5c06ca5001 drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2018-09-25  3937  	return stride / skl_plane_stride_mult(fb, color_plane, rotation);
d21967740f4b7d drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2016-01-28  3938  }
d21967740f4b7d drivers/gpu/drm/i915/intel_display.c Ville Syrjälä 2016-01-28  3939  

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

             reply index

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-14  4:08 Dan Carpenter [this message]
2019-09-16  7:31 ` Jani Nikula
2019-09-16  7:59   ` Dan Carpenter
2019-09-16 12:43     ` Ville Syrjälä

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190914040858.GT20699@kadam \
    --to=dan.carpenter@oracle.com \
    --cc=chris@chris-wilson.co.uk \
    --cc=jani.nikula@intel.com \
    --cc=kbuild-all@01.org \
    --cc=kbuild@01.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lkml.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lkml.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lkml.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lkml.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lkml.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lkml.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lkml.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lkml.kernel.org/lkml/7 lkml/git/7.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lkml.kernel.org/lkml \
		linux-kernel@vger.kernel.org linux-kernel@archiver.kernel.org
	public-inbox-index lkml


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox