linux-kernel - media: imx-jpeg: array subscript 2 is above array bounds (was: Re: kisskb: FAILED linus/m68k-allmodconfig/m68k-gcc8 Wed Dec 14, 11:09)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 14 Dec 2022 17:38:58 +0100
From:   Geert Uytterhoeven <geert@...ux-m68k.org>
To:     Michael Ellerman <mpe@...erman.id.au>
Cc:     Linux Media Mailing List <linux-media@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Arnd Bergmann <arnd@...db.de>
Subject: media: imx-jpeg: array subscript 2 is above array bounds (was: Re:
 kisskb: FAILED linus/m68k-allmodconfig/m68k-gcc8 Wed Dec 14, 11:09)

On Wed, Dec 14, 2022 at 1:16 AM <noreply@...erman.id.au> wrote:
> FAILED linus/m68k-allmodconfig/m68k-gcc8 Wed Dec 14, 11:09
>
> http://kisskb.ellerman.id.au/kisskb/buildresult/14846569/
>
> Commit:   Merge tag 'drm-next-2022-12-13' of git://anongit.freedesktop.org/drm/drm
>           a594533df0f6ca391da003f43d53b336a2d23ffa
> Compiler: m68k-linux-gcc (GCC) 8.5.0 / GNU ld (GNU Binutils) 2.36.1
>
> Possible errors
> ---------------
>
> drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c:641:28: error: array subscript 2 is above array bounds of 'u32[2]' {aka 'unsigned int[2]'} [-Werror=array-bounds]
> drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c:641:28: error: array subscript 3 is above array bounds of 'u32[2]' {aka 'unsigned int[2]'} [-Werror=array-bounds]
> cc1: all warnings being treated as errors
> make[7]: *** [scripts/Makefile.build:250: drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.o] Error 1
> make[6]: *** [scripts/Makefile.build:502: drivers/media/platform/nxp/imx-jpeg] Error 2
> make[5]: *** [scripts/Makefile.build:502: drivers/media/platform/nxp] Error 2
> make[4]: *** [scripts/Makefile.build:502: drivers/media/platform] Error 2
> make[3]: *** [scripts/Makefile.build:502: drivers/media] Error 2
> make[2]: *** [scripts/Makefile.build:502: drivers] Error 2
> make[1]: *** [Makefile:1994: .] Error 2
> make: *** [Makefile:231: __sub-make] Error 2
>
> No warnings found in log.

I am seeing the same with m68k/allmodconfig and gcc version 9.4.0
(Ubuntu 9.4.0-1ubuntu1~20.04).

It is triggered by the second call to mxc_jpeg_get_plane_size()
in mxc_jpeg_dec_irq():

                if (q_data->fmt->mem_planes == 2) {
                        payload = mxc_jpeg_get_plane_size(q_data, 1);
                        vb2_set_plane_payload(&dst_buf->vb2_buf, 1, payload);
                }

However, I am not seeing the issue with x86-64/allmodconfig and gcc
version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1).

Bisected to commit ccc9f1db9c6b0620 ("media: imx-jpeg: Support
contiguous and non contiguous format").

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds