From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [linux-next:master 732/2307] drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:154 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 127
Date: Thu, 02 Jul 2026 08:01:06 +0800 [thread overview]
Message-ID: <202607020734.EHHCtE8Y-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Alex Hung <alex.hung@amd.com>
CC: Alex Deucher <alexander.deucher@amd.com>
CC: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
CC: Chenyu Chen <chen-yu.chen@amd.com>
Hi Alex,
FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: 4f441960e691d37c880d2cc004de06bb5b6bd5e4
commit: f5165625b8b27a46993e0c55b4468bd4e215f7c6 [732/2307] drm/amd/display: Extract backlight code to amdgpu_dm_backlight
:::::: branch date: 8 hours ago
:::::: commit date: 2 weeks ago
config: x86_64-randconfig-r072-20260701 (https://download.01.org/0day-ci/archive/20260702/202607020734.EHHCtE8Y-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607020734.EHHCtE8Y-lkp@intel.com/
New smatch warnings:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:154 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 127
Old smatch warnings:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:158 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 127
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:173 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 127
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:174 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 128
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:175 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 127
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:176 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 128
vim +154 drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c
f5165625b8b27a Alex Hung 2026-04-23 125
f5165625b8b27a Alex Hung 2026-04-23 126 static void convert_custom_brightness(const struct amdgpu_dm_backlight_caps *caps,
f5165625b8b27a Alex Hung 2026-04-23 127 unsigned int min, unsigned int max,
f5165625b8b27a Alex Hung 2026-04-23 128 uint32_t *user_brightness)
f5165625b8b27a Alex Hung 2026-04-23 129 {
f5165625b8b27a Alex Hung 2026-04-23 130 u32 brightness = scale_input_to_fw(min, max, *user_brightness);
f5165625b8b27a Alex Hung 2026-04-23 131 u8 lower_signal, upper_signal, upper_lum, lower_lum, lum;
f5165625b8b27a Alex Hung 2026-04-23 132 int left, right;
f5165625b8b27a Alex Hung 2026-04-23 133
f5165625b8b27a Alex Hung 2026-04-23 134 if (amdgpu_dc_debug_mask & DC_DISABLE_CUSTOM_BRIGHTNESS_CURVE)
f5165625b8b27a Alex Hung 2026-04-23 135 return;
f5165625b8b27a Alex Hung 2026-04-23 136
f5165625b8b27a Alex Hung 2026-04-23 137 if (!caps->data_points)
f5165625b8b27a Alex Hung 2026-04-23 138 return;
f5165625b8b27a Alex Hung 2026-04-23 139
f5165625b8b27a Alex Hung 2026-04-23 140 /*
f5165625b8b27a Alex Hung 2026-04-23 141 * Handle the case where brightness is below the first data point
f5165625b8b27a Alex Hung 2026-04-23 142 * Interpolate between (0,0) and (first_signal, first_lum)
f5165625b8b27a Alex Hung 2026-04-23 143 */
f5165625b8b27a Alex Hung 2026-04-23 144 if (brightness < caps->luminance_data[0].input_signal) {
f5165625b8b27a Alex Hung 2026-04-23 145 lum = DIV_ROUND_CLOSEST(caps->luminance_data[0].luminance * brightness,
f5165625b8b27a Alex Hung 2026-04-23 146 caps->luminance_data[0].input_signal);
f5165625b8b27a Alex Hung 2026-04-23 147 goto scale;
f5165625b8b27a Alex Hung 2026-04-23 148 }
f5165625b8b27a Alex Hung 2026-04-23 149
f5165625b8b27a Alex Hung 2026-04-23 150 left = 0;
f5165625b8b27a Alex Hung 2026-04-23 151 right = caps->data_points - 1;
f5165625b8b27a Alex Hung 2026-04-23 152 while (left <= right) {
f5165625b8b27a Alex Hung 2026-04-23 153 int mid = left + (right - left) / 2;
f5165625b8b27a Alex Hung 2026-04-23 @154 u8 signal = caps->luminance_data[mid].input_signal;
f5165625b8b27a Alex Hung 2026-04-23 155
f5165625b8b27a Alex Hung 2026-04-23 156 /* Exact match found */
f5165625b8b27a Alex Hung 2026-04-23 157 if (signal == brightness) {
f5165625b8b27a Alex Hung 2026-04-23 158 lum = caps->luminance_data[mid].luminance;
f5165625b8b27a Alex Hung 2026-04-23 159 goto scale;
f5165625b8b27a Alex Hung 2026-04-23 160 }
f5165625b8b27a Alex Hung 2026-04-23 161
f5165625b8b27a Alex Hung 2026-04-23 162 if (signal < brightness)
f5165625b8b27a Alex Hung 2026-04-23 163 left = mid + 1;
f5165625b8b27a Alex Hung 2026-04-23 164 else
f5165625b8b27a Alex Hung 2026-04-23 165 right = mid - 1;
f5165625b8b27a Alex Hung 2026-04-23 166 }
f5165625b8b27a Alex Hung 2026-04-23 167
f5165625b8b27a Alex Hung 2026-04-23 168 /* verify bound */
f5165625b8b27a Alex Hung 2026-04-23 169 if (left >= caps->data_points)
f5165625b8b27a Alex Hung 2026-04-23 170 left = caps->data_points - 1;
f5165625b8b27a Alex Hung 2026-04-23 171
f5165625b8b27a Alex Hung 2026-04-23 172 /* At this point, left > right */
f5165625b8b27a Alex Hung 2026-04-23 173 lower_signal = caps->luminance_data[right].input_signal;
f5165625b8b27a Alex Hung 2026-04-23 174 upper_signal = caps->luminance_data[left].input_signal;
f5165625b8b27a Alex Hung 2026-04-23 175 lower_lum = caps->luminance_data[right].luminance;
f5165625b8b27a Alex Hung 2026-04-23 176 upper_lum = caps->luminance_data[left].luminance;
f5165625b8b27a Alex Hung 2026-04-23 177
f5165625b8b27a Alex Hung 2026-04-23 178 /* interpolate */
f5165625b8b27a Alex Hung 2026-04-23 179 if (right == left || !lower_lum)
f5165625b8b27a Alex Hung 2026-04-23 180 lum = upper_lum;
f5165625b8b27a Alex Hung 2026-04-23 181 else
f5165625b8b27a Alex Hung 2026-04-23 182 lum = lower_lum + DIV_ROUND_CLOSEST((upper_lum - lower_lum) *
f5165625b8b27a Alex Hung 2026-04-23 183 (brightness - lower_signal),
f5165625b8b27a Alex Hung 2026-04-23 184 upper_signal - lower_signal);
f5165625b8b27a Alex Hung 2026-04-23 185 scale:
f5165625b8b27a Alex Hung 2026-04-23 186 *user_brightness = scale_fw_to_input(min, max,
f5165625b8b27a Alex Hung 2026-04-23 187 DIV_ROUND_CLOSEST(lum * brightness, 101));
f5165625b8b27a Alex Hung 2026-04-23 188 }
f5165625b8b27a Alex Hung 2026-04-23 189
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-07-02 0:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202607020734.EHHCtE8Y-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.