From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: re: drm/ttm: Print debug information on memory manager when eviction fails Date: Wed, 4 Dec 2013 17:05:59 +0300 Message-ID: <20131204140559.GA11539@elgon.mountain> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) by gabe.freedesktop.org (Postfix) with ESMTP id 6ED0EFAF68 for ; Wed, 4 Dec 2013 06:06:08 -0800 (PST) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org To: jglisse@redhat.com Cc: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org Hello Jerome Glisse, The patch fb53f8621a3f: "drm/ttm: Print debug information on memory manager when eviction fails" from Dec 9, 2009, leads to the following static checker warning: "drivers/gpu/drm/ttm/ttm_bo.c:1494 ttm_mem_reg_is_pci() warn: buffer overflow 'bdev->man' 8 <= 8" drivers/gpu/drm/ttm/ttm_bo.c 56 static inline int ttm_mem_type_from_flags(uint32_t flags, uint32_t *mem_type) 57 { 58 int i; 59 60 for (i = 0; i <= TTM_PL_PRIV5; i++) 61 if (flags & (1 << i)) { 62 *mem_type = i; 63 return 0; 64 } 65 return -EINVAL; 66 } --- [snip] to the ttm_bo_mem_space() function: 869 for (i = 0; i < placement->num_placement; ++i) { 870 ret = ttm_mem_type_from_flags(placement->placement[i], 871 &mem_type); 872 if (ret) 873 return ret; 874 man = &bdev->man[mem_type]; 875 So after ttm_mem_type_from_flags then mem_type can be TTM_PL_PRIV5 (8) but the bdev->man[] array only has TTM_NUM_MEM_TYPES (8) elements so we are one space beyond the end of the array. regards, dan carpenter