| Message ID | 20230407064657.12350-3-jason-jh.lin@mediatek.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fix mediatek-drm coverity issues | expand |
Hi, Jason: On Fri, 2023-04-07 at 14:46 +0800, Jason-JH.Lin wrote: > CERT-C Characters and Strings (CERT STR31-C) > all_drm_priv[cnt] evaluates to an address that could be at negative > offset of an array. > > In mtk_drm_get_all_drm_priv(): > Guarantee that storage for strings has sufficient space for character > data and the null terminator. > > So change cnt to unsigned int and check its max value. > > Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com> > Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 > multi mmsys support") > --- > drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c > b/drivers/gpu/drm/mediatek/mtk_drm_drv.c > index 86255a066faf..fcfa10332166 100644 > --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c > +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c > @@ -378,7 +378,7 @@ static bool mtk_drm_get_all_drm_priv(struct > device *dev) > const struct of_device_id *of_id; > struct device_node *node; > struct device *drm_dev; > - int cnt = 0; > + unsigned int cnt = 0; > int i, j; > > for_each_child_of_node(phandle->parent, node) { > @@ -397,7 +397,7 @@ static bool mtk_drm_get_all_drm_priv(struct > device *dev) > continue; > > all_drm_priv[cnt] = dev_get_drvdata(drm_dev); > - if (all_drm_priv[cnt] && all_drm_priv[cnt]- > >mtk_drm_bound) > + if (cnt < MAX_CRTC && all_drm_priv[cnt] && > all_drm_priv[cnt]->mtk_drm_bound) > cnt++; I would like to add below statement here: if (cnt == MAX_CRTC) break; Regards, CK > } >
Hi CK, Thanks for the reviews. On Mon, 2023-06-12 at 08:21 +0000, CK Hu (胡俊光) wrote: > Hi, Jason: > > On Fri, 2023-04-07 at 14:46 +0800, Jason-JH.Lin wrote: > > CERT-C Characters and Strings (CERT STR31-C) > > all_drm_priv[cnt] evaluates to an address that could be at negative > > offset of an array. > > > > In mtk_drm_get_all_drm_priv(): > > Guarantee that storage for strings has sufficient space for > > character > > data and the null terminator. > > > > So change cnt to unsigned int and check its max value. > > > > Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com> > > Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 > > multi mmsys support") > > --- > > drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c > > b/drivers/gpu/drm/mediatek/mtk_drm_drv.c > > index 86255a066faf..fcfa10332166 100644 > > --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c > > +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c > > @@ -378,7 +378,7 @@ static bool mtk_drm_get_all_drm_priv(struct > > device *dev) > > const struct of_device_id *of_id; > > struct device_node *node; > > struct device *drm_dev; > > - int cnt = 0; > > + unsigned int cnt = 0; > > int i, j; > > > > for_each_child_of_node(phandle->parent, node) { > > @@ -397,7 +397,7 @@ static bool mtk_drm_get_all_drm_priv(struct > > device *dev) > > continue; > > > > all_drm_priv[cnt] = dev_get_drvdata(drm_dev); > > - if (all_drm_priv[cnt] && all_drm_priv[cnt]- > > > mtk_drm_bound) > > > > + if (cnt < MAX_CRTC && all_drm_priv[cnt] && > > all_drm_priv[cnt]->mtk_drm_bound) > > cnt++; > > > I would like to add below statement here: > > if (cnt == MAX_CRTC) > break; > > Regards, > CK OK, I'll change to this statement. Regards, Jason-JH.Lin > > > } > >
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c index 86255a066faf..fcfa10332166 100644 --- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c +++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c @@ -378,7 +378,7 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev) const struct of_device_id *of_id; struct device_node *node; struct device *drm_dev; - int cnt = 0; + unsigned int cnt = 0; int i, j; for_each_child_of_node(phandle->parent, node) { @@ -397,7 +397,7 @@ static bool mtk_drm_get_all_drm_priv(struct device *dev) continue; all_drm_priv[cnt] = dev_get_drvdata(drm_dev); - if (all_drm_priv[cnt] && all_drm_priv[cnt]->mtk_drm_bound) + if (cnt < MAX_CRTC && all_drm_priv[cnt] && all_drm_priv[cnt]->mtk_drm_bound) cnt++; }
CERT-C Characters and Strings (CERT STR31-C) all_drm_priv[cnt] evaluates to an address that could be at negative offset of an array. In mtk_drm_get_all_drm_priv(): Guarantee that storage for strings has sufficient space for character data and the null terminator. So change cnt to unsigned int and check its max value. Signed-off-by: Jason-JH.Lin <jason-jh.lin@mediatek.com> Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support") --- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)