From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [linux-next:master 732/2307] drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:154 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 127
Date: Thu, 02 Jul 2026 08:01:06 +0800 [thread overview]
Message-ID: <202607020734.EHHCtE8Y-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Alex Hung <alex.hung@amd.com>
CC: Alex Deucher <alexander.deucher@amd.com>
CC: Bhawanpreet Lakha <bhawanpreet.lakha@amd.com>
CC: Chenyu Chen <chen-yu.chen@amd.com>
Hi Alex,
FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: 4f441960e691d37c880d2cc004de06bb5b6bd5e4
commit: f5165625b8b27a46993e0c55b4468bd4e215f7c6 [732/2307] drm/amd/display: Extract backlight code to amdgpu_dm_backlight
:::::: branch date: 8 hours ago
:::::: commit date: 2 weeks ago
config: x86_64-randconfig-r072-20260701 (https://download.01.org/0day-ci/archive/20260702/202607020734.EHHCtE8Y-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607020734.EHHCtE8Y-lkp@intel.com/
New smatch warnings:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:154 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 127
Old smatch warnings:
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:158 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 127
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:173 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 127
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:174 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 128
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:175 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 127
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c:176 convert_custom_brightness() error: buffer overflow 'caps->luminance_data' 99 <= 128
vim +154 drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_backlight.c
f5165625b8b27a Alex Hung 2026-04-23 125
f5165625b8b27a Alex Hung 2026-04-23 126 static void convert_custom_brightness(const struct amdgpu_dm_backlight_caps *caps,
f5165625b8b27a Alex Hung 2026-04-23 127 unsigned int min, unsigned int max,
f5165625b8b27a Alex Hung 2026-04-23 128 uint32_t *user_brightness)
f5165625b8b27a Alex Hung 2026-04-23 129 {
f5165625b8b27a Alex Hung 2026-04-23 130 u32 brightness = scale_input_to_fw(min, max, *user_brightness);
f5165625b8b27a Alex Hung 2026-04-23 131 u8 lower_signal, upper_signal, upper_lum, lower_lum, lum;
f5165625b8b27a Alex Hung 2026-04-23 132 int left, right;
f5165625b8b27a Alex Hung 2026-04-23 133
f5165625b8b27a Alex Hung 2026-04-23 134 if (amdgpu_dc_debug_mask & DC_DISABLE_CUSTOM_BRIGHTNESS_CURVE)
f5165625b8b27a Alex Hung 2026-04-23 135 return;
f5165625b8b27a Alex Hung 2026-04-23 136
f5165625b8b27a Alex Hung 2026-04-23 137 if (!caps->data_points)
f5165625b8b27a Alex Hung 2026-04-23 138 return;
f5165625b8b27a Alex Hung 2026-04-23 139
f5165625b8b27a Alex Hung 2026-04-23 140 /*
f5165625b8b27a Alex Hung 2026-04-23 141 * Handle the case where brightness is below the first data point
f5165625b8b27a Alex Hung 2026-04-23 142 * Interpolate between (0,0) and (first_signal, first_lum)
f5165625b8b27a Alex Hung 2026-04-23 143 */
f5165625b8b27a Alex Hung 2026-04-23 144 if (brightness < caps->luminance_data[0].input_signal) {
f5165625b8b27a Alex Hung 2026-04-23 145 lum = DIV_ROUND_CLOSEST(caps->luminance_data[0].luminance * brightness,
f5165625b8b27a Alex Hung 2026-04-23 146 caps->luminance_data[0].input_signal);
f5165625b8b27a Alex Hung 2026-04-23 147 goto scale;
f5165625b8b27a Alex Hung 2026-04-23 148 }
f5165625b8b27a Alex Hung 2026-04-23 149
f5165625b8b27a Alex Hung 2026-04-23 150 left = 0;
f5165625b8b27a Alex Hung 2026-04-23 151 right = caps->data_points - 1;
f5165625b8b27a Alex Hung 2026-04-23 152 while (left <= right) {
f5165625b8b27a Alex Hung 2026-04-23 153 int mid = left + (right - left) / 2;
f5165625b8b27a Alex Hung 2026-04-23 @154 u8 signal = caps->luminance_data[mid].input_signal;
f5165625b8b27a Alex Hung 2026-04-23 155
f5165625b8b27a Alex Hung 2026-04-23 156 /* Exact match found */
f5165625b8b27a Alex Hung 2026-04-23 157 if (signal == brightness) {
f5165625b8b27a Alex Hung 2026-04-23 158 lum = caps->luminance_data[mid].luminance;
f5165625b8b27a Alex Hung 2026-04-23 159 goto scale;
f5165625b8b27a Alex Hung 2026-04-23 160 }
f5165625b8b27a Alex Hung 2026-04-23 161
f5165625b8b27a Alex Hung 2026-04-23 162 if (signal < brightness)
f5165625b8b27a Alex Hung 2026-04-23 163 left = mid + 1;
f5165625b8b27a Alex Hung 2026-04-23 164 else
f5165625b8b27a Alex Hung 2026-04-23 165 right = mid - 1;
f5165625b8b27a Alex Hung 2026-04-23 166 }
f5165625b8b27a Alex Hung 2026-04-23 167
f5165625b8b27a Alex Hung 2026-04-23 168 /* verify bound */
f5165625b8b27a Alex Hung 2026-04-23 169 if (left >= caps->data_points)
f5165625b8b27a Alex Hung 2026-04-23 170 left = caps->data_points - 1;
f5165625b8b27a Alex Hung 2026-04-23 171
f5165625b8b27a Alex Hung 2026-04-23 172 /* At this point, left > right */
f5165625b8b27a Alex Hung 2026-04-23 173 lower_signal = caps->luminance_data[right].input_signal;
f5165625b8b27a Alex Hung 2026-04-23 174 upper_signal = caps->luminance_data[left].input_signal;
f5165625b8b27a Alex Hung 2026-04-23 175 lower_lum = caps->luminance_data[right].luminance;
f5165625b8b27a Alex Hung 2026-04-23 176 upper_lum = caps->luminance_data[left].luminance;
f5165625b8b27a Alex Hung 2026-04-23 177
f5165625b8b27a Alex Hung 2026-04-23 178 /* interpolate */
f5165625b8b27a Alex Hung 2026-04-23 179 if (right == left || !lower_lum)
f5165625b8b27a Alex Hung 2026-04-23 180 lum = upper_lum;
f5165625b8b27a Alex Hung 2026-04-23 181 else
f5165625b8b27a Alex Hung 2026-04-23 182 lum = lower_lum + DIV_ROUND_CLOSEST((upper_lum - lower_lum) *
f5165625b8b27a Alex Hung 2026-04-23 183 (brightness - lower_signal),
f5165625b8b27a Alex Hung 2026-04-23 184 upper_signal - lower_signal);
f5165625b8b27a Alex Hung 2026-04-23 185 scale:
f5165625b8b27a Alex Hung 2026-04-23 186 *user_brightness = scale_fw_to_input(min, max,
f5165625b8b27a Alex Hung 2026-04-23 187 DIV_ROUND_CLOSEST(lum * brightness, 101));
f5165625b8b27a Alex Hung 2026-04-23 188 }
f5165625b8b27a Alex Hung 2026-04-23 189
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-07-02 0:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202607020734.EHHCtE8Y-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox