• Kees Cook's avatar
    drm/nouveau/disp: Fix nvif_outp_acquire_dp() argument size · 4076ea24
    Kees Cook authored
    Both Coverity and GCC with -Wstringop-overflow noticed that
    nvif_outp_acquire_dp() accidentally defined its second argument with 1
    additional element:
    
    drivers/gpu/drm/nouveau/dispnv50/disp.c: In function 'nv50_pior_atomic_enable':
    drivers/gpu/drm/nouveau/dispnv50/disp.c:1813:17: error: 'nvif_outp_acquire_dp' accessing 16 bytes in a region of size 15 [-Werror=stringop-overflow=]
     1813 |                 nvif_outp_acquire_dp(&nv_encoder->outp, nv_encoder->dp.dpcd, 0, 0, false, false);
          |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    drivers/gpu/drm/nouveau/dispnv50/disp.c:1813:17: note: referencing argument 2 of type 'u8[16]' {aka 'unsigned char[16]'}
    drivers/gpu/drm/nouveau/include/nvif/outp.h:24:5: note: in a call to function 'nvif_outp_acquire_dp'
       24 | int nvif_outp_acquire_dp(struct nvif_outp *, u8 dpcd[16],
          |     ^~~~~~~~~~~~~~~~~~~~
    
    Avoid these warnings by defining the argument size using the matching
    define (DP_RECEIVER_CAP_SIZE, 15) instead of having it be a literal
    (and incorrect) value (16).
    Reported-by: default avatarcoverity-bot <keescook+coverity-bot@chromium.org>
    Addresses-Coverity-ID: 1527269 ("Memory - corruptions")
    Addresses-Coverity-ID: 1527268 ("Memory - corruptions")
    Link: https://lore.kernel.org/lkml/202211100848.FFBA2432@keescook/
    Link: https://lore.kernel.org/lkml/202211100848.F4C2819BB@keescook/
    Fixes: 81344372 ("drm/nouveau/disp: move DP link config into acquire")
    Reviewed-by: default avatarLyude Paul <lyude@redhat.com>
    Cc: Ben Skeggs <bskeggs@redhat.com>
    Cc: Karol Herbst <kherbst@redhat.com>
    Cc: David Airlie <airlied@gmail.com>
    Cc: Daniel Vetter <daniel@ffwll.ch>
    Cc: Dave Airlie <airlied@redhat.com>
    Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
    Cc: dri-devel@lists.freedesktop.org
    Cc: nouveau@lists.freedesktop.org
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Link: https://lore.kernel.org/r/20221127183036.never.139-kees@kernel.org
    4076ea24
outp.c 6.39 KB