[bug report] drm/amd/display: Introduce DML2

[Dan Carpenter]

Hello Qingqing Zhuo,

The patch 7966f319c66d: "drm/amd/display: Introduce DML2" from Jul
28, 2023 (linux-next), leads to the following Smatch static checker
warning:

drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:77 map_hw_resources()
error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id' 6 <= 7

drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c:79 map_hw_resources()
error: buffer overflow 'dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id' 6 <= 7

drivers/gpu/drm/amd/amdgpu/../display/dc/dml2/dml2_wrapper.c
    59 static void map_hw_resources(struct dml2_context *dml2,
    60                 struct dml_display_cfg_st *in_out_display_cfg, struct dml_mode_support_info_st *mode_support_info)
    61 {
    62         unsigned int num_pipes = 0;
    63         int i, j;
    64 
    65         for (i = 0; i < __DML_NUM_PLANES__; i++) {
                               ^^^^^^^^^^^^^^^^^^

__DML_NUM_PLANES__ is 8.  This loops 0-7.

    66                 in_out_display_cfg->hw.ODMMode[i] = mode_support_info->ODMMode[i];
    67                 in_out_display_cfg->hw.DPPPerSurface[i] = mode_support_info->DPPPerSurface[i];
    68                 in_out_display_cfg->hw.DSCEnabled[i] = mode_support_info->DSCEnabled[i];
    69                 in_out_display_cfg->hw.NumberOfDSCSlices[i] = mode_support_info->NumberOfDSCSlices[i];
    70                 in_out_display_cfg->hw.DLGRefClkFreqMHz = 24;
    71                 if (dml2->v20.dml_core_ctx.project != dml_project_dcn35 &&
    72                         dml2->v20.dml_core_ctx.project != dml_project_dcn351) {
    73                         /*dGPU default as 50Mhz*/
    74                         in_out_display_cfg->hw.DLGRefClkFreqMHz = 50;
    75                 }
    76                 for (j = 0; j < mode_support_info->DPPPerSurface[i]; j++) {
--> 77                         dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id[num_pipes] = dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_stream_id[i];

Both of these arrays have 6 elements.

    78                         dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_stream_id_valid[num_pipes] = true;
    79                         dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_plane_id[num_pipes] = dml2->v20.scratch.dml_to_dc_pipe_mapping.disp_cfg_to_plane_id[i];
    80                         dml2->v20.scratch.dml_to_dc_pipe_mapping.dml_pipe_idx_to_plane_id_valid[num_pipes] = true;
    81                         num_pipes++;
    82                 }
    83         }
    84 }

regards,
dan carpenter