| Message ID | 20211203092517.3592532-1-keescook@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] drm/dp: Actually read Adjust Request Post Cursor2 register | expand |
On Fri, Dec 03, 2021 at 01:25:17AM -0800, Kees Cook wrote: > The link_status array was not large enough to read the Adjust Request > Post Cursor2 register. Adjust the size to include it. Found with a > -Warray-bounds build: > > drivers/gpu/drm/drm_dp_helper.c: In function 'drm_dp_get_adjust_request_post_cursor': > drivers/gpu/drm/drm_dp_helper.c:59:27: error: array subscript 10 is outside array bounds of 'const u8[6]' {aka 'const unsigned char[6]'} [-Werror=array-bounds] > 59 | return link_status[r - DP_LANE0_1_STATUS]; > | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~ > drivers/gpu/drm/drm_dp_helper.c:147:51: note: while referencing 'link_status' > 147 | u8 drm_dp_get_adjust_request_post_cursor(const u8 link_status[DP_LINK_STATUS_SIZE], > | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Fixes: 79465e0ffeb9 ("drm/dp: Add helper to get post-cursor adjustments") > Signed-off-by: Kees Cook <keescook@chromium.org> > --- > v2: Fix missed array size change in intel_dp_check_mst_status() > --- > drivers/gpu/drm/i915/display/intel_dp.c | 8 ++++---- > include/drm/drm_dp_helper.h | 10 +++++++++- > 2 files changed, 13 insertions(+), 5 deletions(-) This sounds very familiar and I vaguely recall typing up a patch like that a long time ago. But I obviously failed because that never seems to have made it upstream. Or perhaps I'm misremembering and was thinking about this instead: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/338590/ Bonus points for adding that comment with background information on why we need this. Reviewed-by: Thierry Reding <treding@nvidia.com>
On Fri, Dec 03, 2021 at 04:28:56PM +0100, Thierry Reding wrote: > On Fri, Dec 03, 2021 at 01:25:17AM -0800, Kees Cook wrote: > > The link_status array was not large enough to read the Adjust Request > > Post Cursor2 register. Adjust the size to include it. Found with a > > -Warray-bounds build: > > > > drivers/gpu/drm/drm_dp_helper.c: In function 'drm_dp_get_adjust_request_post_cursor': > > drivers/gpu/drm/drm_dp_helper.c:59:27: error: array subscript 10 is outside array bounds of 'const u8[6]' {aka 'const unsigned char[6]'} [-Werror=array-bounds] > > 59 | return link_status[r - DP_LANE0_1_STATUS]; > > | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~ > > drivers/gpu/drm/drm_dp_helper.c:147:51: note: while referencing 'link_status' > > 147 | u8 drm_dp_get_adjust_request_post_cursor(const u8 link_status[DP_LINK_STATUS_SIZE], > > | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > > Fixes: 79465e0ffeb9 ("drm/dp: Add helper to get post-cursor adjustments") > > Signed-off-by: Kees Cook <keescook@chromium.org> > > --- > > v2: Fix missed array size change in intel_dp_check_mst_status() > > --- > > drivers/gpu/drm/i915/display/intel_dp.c | 8 ++++---- > > include/drm/drm_dp_helper.h | 10 +++++++++- > > 2 files changed, 13 insertions(+), 5 deletions(-) > > This sounds very familiar and I vaguely recall typing up a patch like > that a long time ago. But I obviously failed because that never seems > to have made it upstream. > > Or perhaps I'm misremembering and was thinking about this instead: > > https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/338590/ Oh! Yeah, that's the same thing. Looks like that never made its way upstream. :( > > Bonus points for adding that comment with background information on why > we need this. Thanks! Yeah, I needed to really convince myself everything added up and made sense, and figured I should try to capture that research. ;) > Reviewed-by: Thierry Reding <treding@nvidia.com> Thanks! -Kees
diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c index 5a8206298691..97367afc7243 100644 --- a/drivers/gpu/drm/i915/display/intel_dp.c +++ b/drivers/gpu/drm/i915/display/intel_dp.c @@ -3647,17 +3647,17 @@ intel_dp_check_mst_status(struct intel_dp *intel_dp) for (;;) { /* - * The +2 is because DP_DPRX_ESI_LEN is 14, but we then + * The +10 is because while DP_DPRX_ESI_LEN is 14, we then * pass in "esi+10" to drm_dp_channel_eq_ok(), which - * takes a 6-byte array. So we actually need 16 bytes - * here. + * takes a DP_LINK_STATUS_SIZE array. So we actually need + * 10 bytes more than DP_LINK_STATUS_SIZE. * * Somebody who knows what the limits actually are * should check this, but for now this is at least * harmless and avoids a valid compiler warning about * using more of the array than we have allocated. */ - u8 esi[DP_DPRX_ESI_LEN+2] = {}; + u8 esi[DP_LINK_STATUS_SIZE + 10] = {}; bool handled; int retry; diff --git a/include/drm/drm_dp_helper.h b/include/drm/drm_dp_helper.h index 472dac376284..277643d2fe2c 100644 --- a/include/drm/drm_dp_helper.h +++ b/include/drm/drm_dp_helper.h @@ -1517,7 +1517,15 @@ enum drm_dp_phy { #define DP_MST_LOGICAL_PORT_0 8 #define DP_LINK_CONSTANT_N_VALUE 0x8000 -#define DP_LINK_STATUS_SIZE 6 +/* + * DPCD registers in link_status: + * Link Status: 0x202 through 0x204 + * Sink Status: 0x205 + * Adjust Request: 0x206 through 0x207 + * Training Score: 0x208 through 0x20b + * AR Post Cursor2: 0x20c + */ +#define DP_LINK_STATUS_SIZE 11 bool drm_dp_channel_eq_ok(const u8 link_status[DP_LINK_STATUS_SIZE], int lane_count); bool drm_dp_clock_recovery_ok(const u8 link_status[DP_LINK_STATUS_SIZE],
The link_status array was not large enough to read the Adjust Request Post Cursor2 register. Adjust the size to include it. Found with a -Warray-bounds build: drivers/gpu/drm/drm_dp_helper.c: In function 'drm_dp_get_adjust_request_post_cursor': drivers/gpu/drm/drm_dp_helper.c:59:27: error: array subscript 10 is outside array bounds of 'const u8[6]' {aka 'const unsigned char[6]'} [-Werror=array-bounds] 59 | return link_status[r - DP_LANE0_1_STATUS]; | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/drm_dp_helper.c:147:51: note: while referencing 'link_status' 147 | u8 drm_dp_get_adjust_request_post_cursor(const u8 link_status[DP_LINK_STATUS_SIZE], | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 79465e0ffeb9 ("drm/dp: Add helper to get post-cursor adjustments") Signed-off-by: Kees Cook <keescook@chromium.org> --- v2: Fix missed array size change in intel_dp_check_mst_status() --- drivers/gpu/drm/i915/display/intel_dp.c | 8 ++++---- include/drm/drm_dp_helper.h | 10 +++++++++- 2 files changed, 13 insertions(+), 5 deletions(-)