re: drm/vmwgfx: Initial DX support

re: drm/vmwgfx: Initial DX support

[Dan Carpenter]

Hello Thomas Hellstrom,

The patch d80efd5cb3de: "drm/vmwgfx: Initial DX support" from Aug 10,
2015, leads to the following static checker warning:

	drivers/gpu/drm/vmwgfx/vmwgfx_so.c:335 vmw_view_add()
	error: buffer overflow 'vmw_view_define_sizes' 3 <= 3

drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
  2656  static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv,
  2657                                    struct vmw_sw_context *sw_context,
  2658                                    SVGA3dCmdHeader *header)
  2659  {
  2660          struct vmw_resource_val_node *ctx_node = sw_context->dx_ctx_node;
  2661          struct vmw_resource_val_node *srf_node;
  2662          struct vmw_resource *res;
  2663          enum vmw_view_type view_type;
  2664          int ret;
  2665          /*
  2666           * This is based on the fact that all affected define commands have
  2667           * the same initial command body layout.
  2668           */
  2669          struct {
  2670                  SVGA3dCmdHeader header;
  2671                  uint32 defined_id;
  2672                  uint32 sid;
  2673          } *cmd;
  2674  
  2675          if (unlikely(ctx_node == NULL)) {
  2676                  DRM_ERROR("DX Context not set.\n");
  2677                  return -EINVAL;
  2678          }
  2679  
  2680          view_type = vmw_view_cmd_to_type(header->id);

vmw_view_cmd_to_type() returns 0-3.

  2681          cmd = container_of(header, typeof(*cmd), header);
  2682          ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
  2683                                  user_surface_converter,
  2684                                  &cmd->sid, &srf_node);
  2685          if (unlikely(ret != 0))
  2686                  return ret;
  2687  
  2688          res = vmw_context_cotable(ctx_node->res, vmw_view_cotables[view_type]);
                                                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
So we're one space beyond the end of the array, here and other places.

  2689          ret = vmw_cotable_notify(res, cmd->defined_id);
  2690          vmw_resource_unreference(&res);
  2691          if (unlikely(ret != 0))
  2692                  return ret;

regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel