[bug report] drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem

[dan.carpenter at oracle.com]

Hello Hyun Kwon,

The patch d76271d22694: "drm: xlnx: DRM/KMS driver for Xilinx ZynqMP
DisplayPort Subsystem" from Jul 7, 2018, leads to the following
static checker warning:

	drivers/gpu/drm/xlnx/zynqmp_dp.c:594 zynqmp_dp_mode_configure()
	error: iterator underflow 'bws' (-1)-2

drivers/gpu/drm/xlnx/zynqmp_dp.c
   566  static int zynqmp_dp_mode_configure(struct zynqmp_dp *dp, int pclock,
   567                                      u8 current_bw)
   568  {
   569          int max_rate = dp->link_config.max_rate;
   570          u8 bws[3] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7, DP_LINK_BW_5_4 };
   571          u8 max_lanes = dp->link_config.max_lanes;
   572          u8 max_link_rate_code = drm_dp_link_rate_to_bw_code(max_rate);
   573          u8 bpp = dp->config.bpp;
   574          u8 lane_cnt;
   575          s8 i;
   576  
   577          if (current_bw == DP_LINK_BW_1_62) {
   578                  dev_err(dp->dev, "can't downshift. already lowest link rate\n");
   579                  return -EINVAL;
   580          }
   581  
   582          for (i = ARRAY_SIZE(bws) - 1; i >= 0; i--) {
                                              ^^^^^^
This exits with i == -1.

   583                  if (current_bw && bws[i] >= current_bw)
   584                          continue;
   585  
   586                  if (bws[i] <= max_link_rate_code)
   587                          break;
   588          }
   589  
   590          for (lane_cnt = 1; lane_cnt <= max_lanes; lane_cnt <<= 1) {
   591                  int bw;
   592                  u32 rate;
   593  
   594                  bw = drm_dp_bw_code_to_link_rate(bws[i]);
                                                         ^^^^^^
Potential negative array offset.

   595                  rate = zynqmp_dp_max_rate(bw, lane_cnt, bpp);
   596                  if (pclock <= rate) {
   597                          dp->mode.bw_code = bws[i];
   598                          dp->mode.lane_cnt = lane_cnt;
   599                          dp->mode.pclock = pclock;
   600                          return dp->mode.bw_code;
   601                  }
   602          }
   603  
   604          dev_err(dp->dev, "failed to configure link values\n");
   605  
   606          return -EINVAL;
   607  }

regards,
dan carpenter