[bug report] drm/etnaviv: add infrastructure to query perf counter

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Christian Gmeiner,

The patch 9e2c2e273012: "drm/etnaviv: add infrastructure to query
perf counter" from Sep 24, 2017, leads to the following static
checker warning:

	drivers/gpu/drm/etnaviv/etnaviv_drv.c:449 etnaviv_ioctl_pm_query_dom()
	warn: 'args->pipe' is out of bounds '3' vs '2'

drivers/gpu/drm/etnaviv/etnaviv_drv.c
   435  static int etnaviv_ioctl_pm_query_dom(struct drm_device *dev, void *data,
   436          struct drm_file *file)
   437  {
   438          struct etnaviv_drm_private *priv = dev->dev_private;
   439          struct drm_etnaviv_pm_domain *args = data;
   440          struct etnaviv_gpu *gpu;
   441  
   442          if (args->pipe >= ETNA_MAX_PIPES)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
arg->pipe goes up to 3.

   443                  return -EINVAL;
   444  
   445          gpu = priv->gpu[args->pipe];
   446          if (!gpu)
   447                  return -ENXIO;
   448  
   449          return etnaviv_pm_query_dom(gpu, args);
                                                 ^^^^
That is invalid here.

   450  }

drivers/gpu/drm/etnaviv/etnaviv_perfmon.c
   411  static const struct etnaviv_pm_domain_meta doms_meta[] = {
                                                   ^^^^^^^^^
This array has 3 elements.

   412          {
   413                  .nr_domains = ARRAY_SIZE(doms_3d),
   414                  .domains = &doms_3d[0]
   415          },
   416          {
   417                  .nr_domains = ARRAY_SIZE(doms_2d),
   418                  .domains = &doms_2d[0]
   419          },
   420          {
   421                  .nr_domains = ARRAY_SIZE(doms_vg),
   422                  .domains = &doms_vg[0]
   423          }
   424  };
   425  
   426  int etnaviv_pm_query_dom(struct etnaviv_gpu *gpu,
   427          struct drm_etnaviv_pm_domain *domain)
   428  {
   429          const struct etnaviv_pm_domain_meta *meta = &doms_meta[domain->pipe];
                                                             ^^^^^^^^^^^^^^^^^^^^^^^
If domain->pipe is 3 then we are one element beyond the end of the
array.

   430          const struct etnaviv_pm_domain *dom;
   431  
   432          if (domain->iter >= meta->nr_domains)
   433                  return -EINVAL;
   434  
   435          dom = meta->domains + domain->iter;
   436  
   437          domain->id = domain->iter;
   438          domain->nr_signals = dom->nr_signals;
   439          strncpy(domain->name, dom->name, sizeof(domain->name));
   440  
   441          domain->iter++;
   442          if (domain->iter == meta->nr_domains)
   443                  domain->iter = 0xff;
   444  
   445          return 0;
   446  }

regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel