From: Sasha Levin Date: Wed, 14 Apr 2021 15:54:24 +0000 (-0400) Subject: Fixes for 4.4 X-Git-Tag: v5.11.15~17 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=315e6eaef668d925a3ab09d7aba29c9455da713c;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/drm-imx-imx-ldb-fix-out-of-bounds-array-access-warni.patch b/queue-4.4/drm-imx-imx-ldb-fix-out-of-bounds-array-access-warni.patch new file mode 100644 index 00000000000..c014f45bc2d --- /dev/null +++ b/queue-4.4/drm-imx-imx-ldb-fix-out-of-bounds-array-access-warni.patch @@ -0,0 +1,62 @@ +From 0b579e1ad87a885d7a104a675525600df1a1603f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 17:47:41 +0100 +Subject: drm/imx: imx-ldb: fix out of bounds array access warning + +From: Arnd Bergmann + +[ Upstream commit 33ce7f2f95cabb5834cf0906308a5cb6103976da ] + +When CONFIG_OF is disabled, building with 'make W=1' produces warnings +about out of bounds array access: + +drivers/gpu/drm/imx/imx-ldb.c: In function 'imx_ldb_set_clock.constprop': +drivers/gpu/drm/imx/imx-ldb.c:186:8: error: array subscript -22 is below array bounds of 'struct clk *[4]' [-Werror=array-bounds] + +Add an error check before the index is used, which helps with the +warning, as well as any possible other error condition that may be +triggered at runtime. + +The warning could be fixed by adding a Kconfig depedency on CONFIG_OF, +but Liu Ying points out that the driver may hit the out-of-bounds +problem at runtime anyway. + +Signed-off-by: Arnd Bergmann +Reviewed-by: Liu Ying +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/imx-ldb.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c +index b9dc2ef64ed8..74585ba16501 100644 +--- a/drivers/gpu/drm/imx/imx-ldb.c ++++ b/drivers/gpu/drm/imx/imx-ldb.c +@@ -217,6 +217,11 @@ static void imx_ldb_encoder_commit(struct drm_encoder *encoder) + int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN; + int mux = imx_drm_encoder_get_mux_id(imx_ldb_ch->child, encoder); + ++ if (mux < 0 || mux >= ARRAY_SIZE(ldb->clk_sel)) { ++ dev_warn(ldb->dev, "%s: invalid mux %d\n", __func__, mux); ++ return; ++ } ++ + drm_panel_prepare(imx_ldb_ch->panel); + + if (dual) { +@@ -267,6 +272,11 @@ static void imx_ldb_encoder_mode_set(struct drm_encoder *encoder, + unsigned long di_clk = mode->clock * 1000; + int mux = imx_drm_encoder_get_mux_id(imx_ldb_ch->child, encoder); + ++ if (mux < 0 || mux >= ARRAY_SIZE(ldb->clk_sel)) { ++ dev_warn(ldb->dev, "%s: invalid mux %d\n", __func__, mux); ++ return; ++ } ++ + if (mode->clock > 170000) { + dev_warn(ldb->dev, + "%s: mode exceeds 170 MHz pixel clock\n", __func__); +-- +2.30.2 + diff --git a/queue-4.4/series b/queue-4.4/series index 45bb9889838..d7b434786d7 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -32,3 +32,4 @@ net-ieee802154-fix-nl802154-del-llsec-devkey.patch net-ieee802154-forbid-monitor-for-set-llsec-params.patch net-ieee802154-forbid-monitor-for-del-llsec-seclevel.patch net-ieee802154-stop-dump-llsec-params-for-monitors.patch +drm-imx-imx-ldb-fix-out-of-bounds-array-access-warni.patch