Colin King
2021-Feb-03 14:17 UTC
[Nouveau] [PATCH][next] drm/nouveau/fifo/tu102: Fix potential array out of bounds access error
From: Colin Ian King <colin.king at canonical.com>
Currently the for_each_set_bit loop is iterating index engn from 0..31 and
calls to tu102_fifo_recover_engn can potentiall access fifo->engine[engn]
where engn is larger than the array engine (which is currently hard coded
as 16 elements). Avoid any potential array out of bounds accesses by
replacing the hard coded value 32 with the number of elements in the array.
Addresses-Coverity: ("Out-of-bounds access")
Fixes: 26a0cfc163ab ("drm/nouveau/fifo/tu102: FIFO interrupt fixes for
Turing")
Signed-off-by: Colin Ian King <colin.king at canonical.com>
---
drivers/gpu/drm/nouveau/nvkm/engine/fifo/tu102.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/tu102.c
b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/tu102.c
index 14e5b70e0255..1f33f8c757bf 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/tu102.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/tu102.c
@@ -366,7 +366,7 @@ tu102_fifo_intr_ctxsw_timeout(struct gk104_fifo *fifo)
engm = nvkm_rd32(device, 0x2a30);
nvkm_wr32(device, 0x2a30, engm);
- for_each_set_bit(engn, &engm, 32)
+ for_each_set_bit(engn, &engm, ARRAY_SIZE(fifo->engine))
tu102_fifo_recover_engn(fifo, engn);
spin_unlock_irqrestore(&fifo->base.lock, flags);
--
2.29.2