linux-kernel - Re: [PATCH] drm/i915/mtl: avoid stringop-overflow warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87edhlbj16.fsf@intel.com>
Date:   Mon, 23 Oct 2023 15:49:41 +0300
From:   Jani Nikula <jani.nikula@...ux.intel.com>
To:     Arnd Bergmann <arnd@...nel.org>,
        Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
        Rodrigo Vivi <rodrigo.vivi@...el.com>,
        Tvrtko Ursulin <tvrtko.ursulin@...ux.intel.com>,
        David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>,
        Badal Nilawar <badal.nilawar@...el.com>,
        Ashutosh Dixit <ashutosh.dixit@...el.com>
Cc:     Arnd Bergmann <arnd@...db.de>,
        Matt Roper <matthew.d.roper@...el.com>,
        Vinay Belgaumkar <vinay.belgaumkar@...el.com>,
        intel-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/i915/mtl: avoid stringop-overflow warning

On Mon, 16 Oct 2023, Arnd Bergmann <arnd@...nel.org> wrote:
> From: Arnd Bergmann <arnd@...db.de>
>
> The newly added memset() causes a warning for some reason I could not figure out:
>
> In file included from arch/x86/include/asm/string.h:3,
>                  from drivers/gpu/drm/i915/gt/intel_rc6.c:6:
> In function 'rc6_res_reg_init',
>     inlined from 'intel_rc6_init' at drivers/gpu/drm/i915/gt/intel_rc6.c:610:2:
> arch/x86/include/asm/string_32.h:195:29: error: '__builtin_memset' writing 16 bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]
>   195 | #define memset(s, c, count) __builtin_memset(s, c, count)
>       |                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/gpu/drm/i915/gt/intel_rc6.c:584:9: note: in expansion of macro 'memset'
>   584 |         memset(rc6->res_reg, INVALID_MMIO_REG.reg, sizeof(rc6->res_reg));
>       |         ^~~~~~
> In function 'intel_rc6_init':
>
> Change it to an normal initializer and an added memcpy() that does not have
> this problem.
>
> Fixes: 4bb9ca7ee0745 ("drm/i915/mtl: C6 residency and C state type for MTL SAMedia")
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> ---
>  drivers/gpu/drm/i915/gt/intel_rc6.c | 16 ++++++++++------
>  1 file changed, 10 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_rc6.c b/drivers/gpu/drm/i915/gt/intel_rc6.c
> index 8b67abd720be8..7090e4be29cb6 100644
> --- a/drivers/gpu/drm/i915/gt/intel_rc6.c
> +++ b/drivers/gpu/drm/i915/gt/intel_rc6.c
> @@ -581,19 +581,23 @@ static void __intel_rc6_disable(struct intel_rc6 *rc6)
>  
>  static void rc6_res_reg_init(struct intel_rc6 *rc6)
>  {
> -	memset(rc6->res_reg, INVALID_MMIO_REG.reg, sizeof(rc6->res_reg));

That's just bollocks. memset() is byte granularity, while
INVALID_MMIO_REG.reg is u32. If the value was anything other than 0,
this would break.

And you're not supposed to look at the guts of i915_reg_t to begin with,
that's why it's a typedef. Basically any code that accesses the members
of i915_reg_t outside of its implementation are doing it wrong.

Reviewed-by: Jani Nikula <jani.nikula@...el.com>


> +	i915_reg_t res_reg[INTEL_RC6_RES_MAX] = {
> +		[0 ... INTEL_RC6_RES_MAX - 1] = INVALID_MMIO_REG,
> +	};
>  
>  	switch (rc6_to_gt(rc6)->type) {
>  	case GT_MEDIA:
> -		rc6->res_reg[INTEL_RC6_RES_RC6] = MTL_MEDIA_MC6;
> +		res_reg[INTEL_RC6_RES_RC6] = MTL_MEDIA_MC6;
>  		break;
>  	default:
> -		rc6->res_reg[INTEL_RC6_RES_RC6_LOCKED] = GEN6_GT_GFX_RC6_LOCKED;
> -		rc6->res_reg[INTEL_RC6_RES_RC6] = GEN6_GT_GFX_RC6;
> -		rc6->res_reg[INTEL_RC6_RES_RC6p] = GEN6_GT_GFX_RC6p;
> -		rc6->res_reg[INTEL_RC6_RES_RC6pp] = GEN6_GT_GFX_RC6pp;
> +		res_reg[INTEL_RC6_RES_RC6_LOCKED] = GEN6_GT_GFX_RC6_LOCKED;
> +		res_reg[INTEL_RC6_RES_RC6] = GEN6_GT_GFX_RC6;
> +		res_reg[INTEL_RC6_RES_RC6p] = GEN6_GT_GFX_RC6p;
> +		res_reg[INTEL_RC6_RES_RC6pp] = GEN6_GT_GFX_RC6pp;
>  		break;
>  	}
> +
> +	memcpy(rc6->res_reg, res_reg, sizeof(res_reg));
>  }
>  
>  void intel_rc6_init(struct intel_rc6 *rc6)

-- 
Jani Nikula, Intel