[bug report] drm/etnaviv: add infrastructure to query perf counter

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Christian Gmeiner,

The patch 9e2c2e273012: "drm/etnaviv: add infrastructure to query
perf counter" from Sep 24, 2017, leads to the following static
checker warning:

	drivers/gpu/drm/etnaviv/etnaviv_drv.c:410 etnaviv_ioctl_pm_query_dom()
	warn: 'args->pipe' is out of bounds '3' vs '2'

drivers/gpu/drm/etnaviv/etnaviv_drv.c
    396 static int etnaviv_ioctl_pm_query_dom(struct drm_device *dev, void *data,
    397 	struct drm_file *file)
    398 {
    399 	struct etnaviv_drm_private *priv = dev->dev_private;
    400 	struct drm_etnaviv_pm_domain *args = data;
    401 	struct etnaviv_gpu *gpu;
    402 
    403 	if (args->pipe >= ETNA_MAX_PIPES)
                                  ^^^^^^^^^^^^^^
ETNA_MAX_PIPES is 4.

    404 		return -EINVAL;
    405 
    406 	gpu = priv->gpu[args->pipe];
    407 	if (!gpu)
    408 		return -ENXIO;
    409 
--> 410 	return etnaviv_pm_query_dom(gpu, args);
    411 }

drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
   389  static const struct etnaviv_pm_domain_meta doms_meta[] = {
   390          {
   391                  .nr_domains = ARRAY_SIZE(doms_3d),
   392                  .domains = &doms_3d[0]
   393          },
   394          {
   395                  .nr_domains = ARRAY_SIZE(doms_2d),
   396                  .domains = &doms_2d[0]
   397          },
   398          {
   399                  .nr_domains = ARRAY_SIZE(doms_vg),
   400                  .domains = &doms_vg[0]
   401          }


This array only has 3 elements.

   402  };
   403  
   404  int etnaviv_pm_query_dom(struct etnaviv_gpu *gpu,
   405          struct drm_etnaviv_pm_domain *domain)
   406  {
   407          const struct etnaviv_pm_domain_meta *meta = &doms_meta[domain->pipe];
                                                             ^^^^^^^^^^^^^^^^^^^^^^^
Out of bounds.

   408          const struct etnaviv_pm_domain *dom;
   409  
   410          if (domain->iter >= meta->nr_domains)
   411                  return -EINVAL;
   412  
   413          dom = meta->domains + domain->iter;
   414  
   415          domain->id = domain->iter;
   416          domain->nr_signals = dom->nr_signals;
   417          strncpy(domain->name, dom->name, sizeof(domain->name));
   418  
   419          domain->iter++;
   420          if (domain->iter == meta->nr_domains)
   421                  domain->iter = 0xff;
   422  
   423          return 0;
   424  }

regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel