From ce17308ffd173ea0c478723d429364e16acec5c8 Mon Sep 17 00:00:00 2001 From: Wen Yang Date: Sun, 25 Dec 2022 23:10:58 +0800 Subject: [PATCH] =?utf8?q?drm/amd/display:=C2=A0fix=C2=A0array-bounds?= =?utf8?q?=C2=A0errors=C2=A0in=20dc=5Fstream=5Fremove=5Fwriteback()?= MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit The following errors occurred when using gcc 7.5.0-3ubuntu1~18.04: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c: In function ‘dc_stream_remove_writeback’: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:543:55: warning: array subscript is above array bounds [-Warray-bounds]      stream->writeback_info[j] = stream->writeback_info[i];                                  ~~~~~~~~~~~~~~~~~~~~~~^~~ Add a check to make sure that num_wb_info won't overflowing the writeback_info buffer. Fixes: 6fbefb84a98e ("drm/amd/display: Add DC core changes for DCN2") Signed-off-by: Wen Yang Cc: Aurabindo Pillai Cc: Hamza Mahfooz Cc: Guenter Roeck Cc: Alex Deucher Cc: Harry Wentland  Cc: Leo Li  Cc: amd-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher --- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c index 20e534f..9825c30 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c @@ -481,6 +481,7 @@ bool dc_stream_add_writeback(struct dc *dc, } if (!isDrc) { + ASSERT(stream->num_wb_info + 1 <= MAX_DWB_PIPES); stream->writeback_info[stream->num_wb_info++] = *wb_info; } @@ -526,6 +527,11 @@ bool dc_stream_remove_writeback(struct dc *dc, return false; } + if (stream->num_wb_info > MAX_DWB_PIPES) { + dm_error("DC: num_wb_info is invalid!\n"); + return false; + } + // stream->writeback_info[dwb_pipe_inst].wb_enabled = false; for (i = 0; i < stream->num_wb_info; i++) { /*dynamic update*/ @@ -540,7 +546,8 @@ bool dc_stream_remove_writeback(struct dc *dc, if (stream->writeback_info[i].wb_enabled) { if (j < i) /* trim the array */ - stream->writeback_info[j] = stream->writeback_info[i]; + memcpy(&stream->writeback_info[j], &stream->writeback_info[i], + sizeof(struct dc_writeback_info)); j++; } } -- 2.7.4