From patchwork Thu Mar 15 16:19:57 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnd Bergmann X-Patchwork-Id: 131814 Delivered-To: patch@linaro.org Received: by 10.80.210.197 with SMTP id q5csp1677752edg; Thu, 15 Mar 2018 09:20:24 -0700 (PDT) X-Google-Smtp-Source: AG47ELslmvLSyhFKRxsha6xvZPAR8MEb9DTLY/RLquodkt4WdxF4C6KFFin5x0SMh1KezBT4z2wM X-Received: by 10.101.101.204 with SMTP id y12mr7270427pgv.142.1521130824461; Thu, 15 Mar 2018 09:20:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1521130824; cv=none; d=google.com; s=arc-20160816; b=wLZDA+9NmrieMvKsoZO+l9XZ0uxHPE/yIp8sjiKkaZoIaUtgc+nxbaHA+qqzaQ0xvK W3ayq78MNI2RVTgQwgfgU335v7izBbGEe+c2yUtVxjXQeVhFseVJGLch66oHg3drdm/S 6DYSJHDzpCyjxaEDFK86K/9mHQHHN/Ldtjfz5iVM+flMTxiIY/RjtE1ojEVhw5t1QDfS VbPn0PtTDIKrBMhu8Ba5ZUuyUIT9puWI/qInhpPlpGMM+ssjOuMHhbJcLkhN9XkDZ4bM +iRl0dBnh71j2bUSvKgK30GnkvTD2wy5HlMrzHY/4YmmuPRE+KO9p0xb71UVkg5s3O8A TRVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :arc-authentication-results; bh=ykj534Gtm8QRWy4vL/CkxI2nK84o+OwP8bQwJJRAOj8=; b=UckERgl86qRavBBpf7BK8FE8JK+1L6bSw/17eSjakWosKteidm9DTQiQF3vcHGdGmn NHnZxZsmK21EuxxutA6MbrfM1fe8Gilko5KZQLo6+jeHwWwEswE3/zQrVaKXRBsMvz4H XTKHLoEMc3Mnw/M0NbJgt8wub7ClFb9NjKwIXwv+6WOS+1dY0wuMkdhd+Ui/iDSXNKwX jkcRdnebJMqZoxsRl4QPLMpf/NnEkPwcj1uBKUq6iAOneiwRFLrMwMEe8bR/rYkSbxJ+ kCwIelRHWnCZdRp2yjRI+jRGfcpvPkdK7ne+IQkSWOWe0ubd9W2BWgBX/6/15Tmvij4Y H5xg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id u16-v6si4212005plq.183.2018.03.15.09.20.24; Thu, 15 Mar 2018 09:20:24 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752332AbeCOQUV (ORCPT + 28 others); Thu, 15 Mar 2018 12:20:21 -0400 Received: from mout.kundenserver.de ([212.227.17.24]:39817 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751997AbeCOQUS (ORCPT ); Thu, 15 Mar 2018 12:20:18 -0400 Received: from wuerfel.lan ([95.208.111.237]) by mrelayeu.kundenserver.de (mreue102 [212.227.15.145]) with ESMTPA (Nemesis) id 0M40x8-1eeIIw2PYo-00rYyG; Thu, 15 Mar 2018 17:20:12 +0100 From: Arnd Bergmann To: Philipp Zabel Cc: Arnd Bergmann , Lucas Stach , Tobias Jordan , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH] [v3] gpu: ipu-v3: prg: avoid possible array underflow Date: Thu, 15 Mar 2018 17:19:57 +0100 Message-Id: <20180315162011.807909-1-arnd@arndb.de> X-Mailer: git-send-email 2.9.0 X-Provags-ID: V03:K0:lbA6dTr3mwpT4NT80Zxn6D8aDnyLcSfwMFfQGKk6/a0pnCmFf5w TmalFCnjJgMDW/MyUnC2x8wa9yG1QC0LL21SLf9tisCkMuLjFnPYp1dv+d6hOeTW6PVNiWs bgAxPgilbqVi3KCZA6vO9lNTV7CaelsKSZO5GF+mn0Ndb7GxUJU63f/k6iDk038NmUL9Fta VM966JJheg+wFLYJAGDJQ== X-UI-Out-Filterresults: notjunk:1; V01:K0:c8Ec0vxPw9k=:QqjXW71jkiJKnr2askDiqQ XBaeowtBL/I3O8FVP23PZvwtgtSh1g0BqSjKp30OeMAiNgEbDPFZYeSACDAvPAh7nxCiace2t JForuaW31Epfo4a21wNfjRSnRuhNGNwN8VYlsT8YVkC4gsfXytU2Aq2hRkvE3H9+U3LC+5Q8U zMzzkDr00DBgXzIQpsGJJbfJ9Zwbpod77va7NuVkIGK1iJ+WEmtbnzRx1yT9Z1h4ECpZQGM1v tEYGfkRquubxfcGvvPuTxwKm5KDjgteH5tLXXm/EZIXLXsHX4YluILjk1XhtdY8kzDHOWZF1E lRf9J1i4yCIMU+r9oADjhGwtDJSpaJotjLlRjs/fc44SF4P5YNW5uW82NyICcW5gacYRS/cRE muy+Y75O8T5B6ms+hfaHnUC4TA+NCOVq507/zcWlJA/onwmeMHaIyav7+PjQHu686atOW1JTk 8KFnsqwor26UMBm+8bKVxFSQFhoO2BKUXByhirVvVzGy2BZ32ku4LHFUGdr8WLyR+DvKfV/QI XKTmeaX/iIP3hVFc/OrqHssiHOxgWLhlbcnIWqQYC4ot4TqsTqeu6XoX/y5xkZhxdYuSnpnrl QKwhADgNn6cuf7JxeWR3ZkVog1i/SEVmaUKq1QbacppRP1icfbeA6h4Mnek3LEU0k6UFS6/55 fnqEWuNjuERY1nnxoNFoGRFZpIvEJdZf4a092Ww+K95cbi/jwFj6ZSEzcNphSRHQ3RMWoWPjz piwAxNWYp1lhRi1KV6tXPeJaTMBOx03JRLECoQ== Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org gcc-8 reports that we access an array with a negative index in an error case: drivers/gpu/ipu-v3/ipu-prg.c: In function 'ipu_prg_channel_disable': drivers/gpu/ipu-v3/ipu-prg.c:252:43: error: array subscript -22 is below array bounds of 'struct ipu_prg_channel[3]' [-Werror=array-bounds] This moves the range check in front of the first time that variable gets used. Signed-off-by: Arnd Bergmann ---- v1: Originally sent on Dec 4, 2017. v2: Sent again on Jan 16, after no reply, Phillipp said it was merged v3: Ran into a related problem with CONFIG_UBSAN, sent again fixing both --- drivers/gpu/ipu-v3/ipu-prg.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) -- 2.9.0 diff --git a/drivers/gpu/ipu-v3/ipu-prg.c b/drivers/gpu/ipu-v3/ipu-prg.c index 97b99500153d..83f9dd934a5d 100644 --- a/drivers/gpu/ipu-v3/ipu-prg.c +++ b/drivers/gpu/ipu-v3/ipu-prg.c @@ -250,10 +250,14 @@ void ipu_prg_channel_disable(struct ipuv3_channel *ipu_chan) { int prg_chan = ipu_prg_ipu_to_prg_chan(ipu_chan->num); struct ipu_prg *prg = ipu_chan->ipu->prg_priv; - struct ipu_prg_channel *chan = &prg->chan[prg_chan]; + struct ipu_prg_channel *chan; u32 val; - if (!chan->enabled || prg_chan < 0) + if (prg_chan < 0) + return; + + chan = &prg->chan[prg_chan]; + if (!chan->enabled) return; pm_runtime_get_sync(prg->dev); @@ -280,13 +284,15 @@ int ipu_prg_channel_configure(struct ipuv3_channel *ipu_chan, { int prg_chan = ipu_prg_ipu_to_prg_chan(ipu_chan->num); struct ipu_prg *prg = ipu_chan->ipu->prg_priv; - struct ipu_prg_channel *chan = &prg->chan[prg_chan]; + struct ipu_prg_channel *chan; u32 val; int ret; if (prg_chan < 0) return prg_chan; + chan = &prg->chan[prg_chan]; + if (chan->enabled) { ipu_pre_update(prg->pres[chan->used_pre], *eba); return 0;