Hello Christian Gmeiner,

The patch 9e2c2e273012: "drm/etnaviv: add infrastructure to query perf counter" from Sep 24, 2017, leads to the following static checker warning:

drivers/gpu/drm/etnaviv/etnaviv_drv.c:449 etnaviv_ioctl_pm_query_dom() warn: 'args->pipe' is out of bounds '3' vs '2'

drivers/gpu/drm/etnaviv/etnaviv_drv.c 435 static int etnaviv_ioctl_pm_query_dom(struct drm_device *dev, void *data, 436 struct drm_file *file) 437 { 438 struct etnaviv_drm_private *priv = dev->dev_private; 439 struct drm_etnaviv_pm_domain *args = data; 440 struct etnaviv_gpu *gpu; 441 442 if (args->pipe >= ETNA_MAX_PIPES) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ arg->pipe goes up to 3.

443 return -EINVAL; 444 445 gpu = priv->gpu[args->pipe]; 446 if (!gpu) 447 return -ENXIO; 448 449 return etnaviv_pm_query_dom(gpu, args); ^^^^ That is invalid here.

450 }

drivers/gpu/drm/etnaviv/etnaviv_perfmon.c 411 static const struct etnaviv_pm_domain_meta doms_meta[] = { ^^^^^^^^^ This array has 3 elements.

412 { 413 .nr_domains = ARRAY_SIZE(doms_3d), 414 .domains = &doms_3d[0] 415 }, 416 { 417 .nr_domains = ARRAY_SIZE(doms_2d), 418 .domains = &doms_2d[0] 419 }, 420 { 421 .nr_domains = ARRAY_SIZE(doms_vg), 422 .domains = &doms_vg[0] 423 } 424 }; 425 426 int etnaviv_pm_query_dom(struct etnaviv_gpu *gpu, 427 struct drm_etnaviv_pm_domain *domain) 428 { 429 const struct etnaviv_pm_domain_meta *meta = &doms_meta[domain->pipe]; ^^^^^^^^^^^^^^^^^^^^^^^ If domain->pipe is 3 then we are one element beyond the end of the array.

430 const struct etnaviv_pm_domain *dom; 431 432 if (domain->iter >= meta->nr_domains) 433 return -EINVAL; 434 435 dom = meta->domains + domain->iter; 436 437 domain->id = domain->iter; 438 domain->nr_signals = dom->nr_signals; 439 strncpy(domain->name, dom->name, sizeof(domain->name)); 440 441 domain->iter++; 442 if (domain->iter == meta->nr_domains) 443 domain->iter = 0xff; 444 445 return 0; 446 }

regards, dan carpenter