From patchwork Thu Nov 16 06:30:28 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Shumilin X-Patchwork-Id: 13457719 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 50E14C197A0 for ; Thu, 16 Nov 2023 09:07:11 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 496F210E145; Thu, 16 Nov 2023 09:07:08 +0000 (UTC) X-Greylist: delayed 584 seconds by postgrey-1.36 at gabe; Thu, 16 Nov 2023 06:40:46 UTC Received: from mail.nppct.ru (mail.nppct.ru [195.133.245.4]) by gabe.freedesktop.org (Postfix) with ESMTPS id D0A4410E0FE for ; Thu, 16 Nov 2023 06:40:46 +0000 (UTC) Received: from mail.nppct.ru (localhost [127.0.0.1]) by mail.nppct.ru (Postfix) with ESMTP id 59D5E1C0D49 for ; Thu, 16 Nov 2023 09:30:58 +0300 (MSK) Authentication-Results: mail.nppct.ru (amavisd-new); dkim=pass (1024-bit key) reason="pass (just generated, assumed good)" header.d=nppct.ru DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nppct.ru; h= content-transfer-encoding:mime-version:x-mailer:message-id:date :date:subject:subject:to:from:from; s=dkim; t=1700116257; x= 1700980258; bh=/9MO8o7o6nntPf+7n/of28fm2Es83s6OBU6s1H6hwTA=; b=s HeYkQoRwz0Szky7dzmleNuXRv0FBJ1caHfRp8sEEfuAk4BkB2Y4qXHxHKJWmSK4l bV0GeAYJQoAbHhCBqOln0jVXD6sFILijoHK72Vxsf+JUwiBXbXVP48GmV2xJlsxw h82wbF4wQWDkQ4ABYjqgCpsKlgGXoNb+W920jsh1Bw= X-Virus-Scanned: Debian amavisd-new at mail.nppct.ru Received: from mail.nppct.ru ([127.0.0.1]) by mail.nppct.ru (mail.nppct.ru [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id oiCozx535_4d for ; Thu, 16 Nov 2023 09:30:57 +0300 (MSK) Received: from localhost.localdomain (mail.dev-ai-melanoma.ru [185.130.227.204]) by mail.nppct.ru (Postfix) with ESMTPSA id 57B921C061A; Thu, 16 Nov 2023 09:30:55 +0300 (MSK) From: Andrey Shumilin To: Karol Herbst Subject: [PATCH] therm.c: Adding an array index check before accessing an element. Date: Thu, 16 Nov 2023 09:30:28 +0300 Message-Id: <20231116063028.35871-1-shum.sdl@nppct.ru> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-Mailman-Approved-At: Thu, 16 Nov 2023 09:06:53 +0000 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: nouveau@lists.freedesktop.org, Andrey Shumilin , linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, vefanov@ispras.ru, ykarpov@ispras.ru, Danilo Krummrich , vmerzlyakov@ispras.ru, khoroshilov@ispras.ru Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" It is possible to access an element at index -1 if at the first iteration of the loop the result of switch is equal to 0x25 Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Andrey Shumilin --- drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c index 5babc5a7c7d5..78387053f214 100644 --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/therm.c @@ -180,6 +180,8 @@ nvbios_therm_fan_parse(struct nvkm_bios *bios, struct nvbios_therm_fan *fan) cur_trip->fan_duty = duty_lut[(value & 0xf000) >> 12]; break; case 0x25: + if (fan->nr_fan_trip == 0) + fan->nr_fan_trip++; cur_trip = &fan->trip[fan->nr_fan_trip - 1]; cur_trip->fan_duty = value; break;