Re: [PATCH] fbdev: atyfb: fix array overflow

On Thursday, June 23, 2016 3:28:25 AM CEST Ville Syrjälä wrote:

On Wed, Jun 22, 2016 at 02:37:11PM +0200, Arnd Bergmann wrote:

quoted

When building with CONFIG_UBSAN_SANITIZE_ALL on ARM, I get this
gcc warning for atyfb:

drivers/video/fbdev/aty/atyfb_base.c: In function 'aty_bl_update_status':
drivers/video/fbdev/aty/atyfb_base.c:167:33: warning: array subscript is above array bounds [-Warray-bounds]
drivers/video/fbdev/aty/atyfb_base.c:152:26: warning: array subscript is above array bounds [-Warray-bounds]

Apparently the warning is correct and there is indeed an overflow,

Nope. All the LCD register indexes on the Rage LT (the only relevant
chip for this code path) should stay below the table size. At least
I can't see any place where we'd walk past the end.

I don't understand what you mean: the warning is about LCD_MISC_CNTL,
which is defined as 0x14, while the array size is 9 and that is smaller.

Is there something more subtle going on than what gcc sees?

	Arnd