linux-kernel - Re: [Nouveau] [PATCH][next] drm/nouveau/disp: avoid potential overflow on shift of int value

Open Source and information security mailing list archives

Message-ID: <CAKb7Uvjwid5WSyCm2_+sZ2EPauaG0ef9QS2gm_tSk53hXtkHDA@mail.gmail.com>
Date:   Sun, 27 May 2018 22:14:05 -0400
From:   Ilia Mirkin <imirkin@...m.mit.edu>
To:     Colin King <colin.king@...onical.com>
Cc:     Ben Skeggs <bskeggs@...hat.com>, David Airlie <airlied@...ux.ie>,
        dri-devel <dri-devel@...ts.freedesktop.org>,
        nouveau <nouveau@...ts.freedesktop.org>,
        kernel-janitors@...r.kernel.org,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [Nouveau] [PATCH][next] drm/nouveau/disp: avoid potential
 overflow on shift of int value

On Sun, May 27, 2018 at 5:54 PM, Colin King <colin.king@...onical.com> wrote:
> From: Colin Ian King <colin.king@...onical.com>
>
> The constant values being shifted are 32 bit integers and may potentially
> overflow on the shift.  Avoid this potential overflow by making them
> unsigned long long values before the shift.
>
> Detected by CoverityScan, CID#1469383, 1469400 ("Unintentional
> integer overflow")
>
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>  drivers/gpu/drm/nouveau/nvkm/engine/disp/changf119.c | 2 +-
>  drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c  | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/changf119.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/changf119.c
> index 29e6dd58ac48..99b94802ed63 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/changf119.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/changf119.c
> @@ -52,7 +52,7 @@ void
>  gf119_disp_chan_intr(struct nv50_disp_chan *chan, bool en)
>  {
>         struct nvkm_device *device = chan->disp->base.engine.subdev.device;
> -       const u64 mask = 0x00000001 << chan->chid.user;
> +       const u64 mask = 0x00000001ULL << chan->chid.user;

I'm pretty sure all of these should just be u32 (below as well). The
registers that this is masking are all 32-bit, more doesn't make
sense.

>         if (!en) {
>                 nvkm_mask(device, 0x610090, mask, 0x00000000);
>                 nvkm_mask(device, 0x6100a0, mask, 0x00000000);
> diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
> index 57719f675eec..43ae3b092e43 100644
> --- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
> +++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
> @@ -166,7 +166,7 @@ void
>  nv50_disp_chan_intr(struct nv50_disp_chan *chan, bool en)
>  {
>         struct nvkm_device *device = chan->disp->base.engine.subdev.device;
> -       const u64 mask = 0x00010001 << chan->chid.user;
> +       const u64 mask = 0x00010001ULL << chan->chid.user;
>         const u64 data = en ? 0x00010000 : 0x00000000;
>         nvkm_mask(device, 0x610028, mask, data);
>  }
> --
> 2.17.0
>
> _______________________________________________
> Nouveau mailing list
> Nouveau@...ts.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/nouveau

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives