On Sat, May 18, 2024 at 11:29:23AM -0700, Guenter Roeck wrote: > Trying to build parisc:allmodconfig with gcc 12.x or later results > in the following build error. > > drivers/gpu/drm/nouveau/nvif/object.c: In function 'nvif_object_mthd': > drivers/gpu/drm/nouveau/nvif/object.c:161:9: error: > 'memcpy' accessing 4294967264 or more bytes at offsets 0 and 32 > overlaps 6442450881 bytes at offset -2147483617 [-Werror=restrict] > 161 | memcpy(data, args->mthd.data, size); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > drivers/gpu/drm/nouveau/nvif/object.c: In function 'nvif_object_ctor': > drivers/gpu/drm/nouveau/nvif/object.c:298:17: error: > 'memcpy' accessing 4294967240 or more bytes at offsets 0 and 56 > overlaps 6442450833 bytes at offset -2147483593 [-Werror=restrict] > 298 | memcpy(data, args->new.data, size); > > gcc assumes that 'sizeof(*args) + size' can overflow, which would result > in the problem. > > The problem is not new, only it is now no longer a warning but an error > since W=1 has been enabled for the drm subsystem and since Werror is > enabled for test builds. > > Rearrange arithmetic and use check_add_overflow() for validating the > allocation size to avoid the overflow. > > Fixes: a61ddb4393ad ("drm: enable (most) W=1 warnings by default across the > subsystem") > Cc: Javier Martinez Canillas <javi...@redhat.com> > Cc: Jani Nikula <jani.nik...@intel.com> > Cc: Thomas Zimmermann <tzimmerm...@suse.de> > Cc: Danilo Krummrich <d...@redhat.com> > Cc: Maxime Ripard <mrip...@kernel.org> > Cc: Kees Cook <keesc...@chromium.org> > Cc: Christophe JAILLET <christophe.jail...@wanadoo.fr> > Signed-off-by: Guenter Roeck <li...@roeck-us.net>
Yeah, looks good to me. Thanks! Reviewed-by: Kees Cook <keesc...@chromium.org> -- Kees Cook