linux-kernel - Re: [Intel-gfx] drm_modes: signed integer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BaLsmzqZNUi-nVbYiLstRgspKGlLahAI8vM2_NPfos2PxM0N9lycj-Zn5TdqNtEHB-jeWgmzw9EHJxq4H5552tVi4bAZXTLnP0y1QsTPFtY=@emersion.fr>
Date:   Fri, 23 Oct 2020 15:14:20 +0000
From:   Simon Ser <contact@...rsion.fr>
To:     Ville Syrjälä <ville.syrjala@...ux.intel.com>
Cc:     Randy Dunlap <rdunlap@...radead.org>,
        David Airlie <airlied@...ux.ie>,
        intel-gfx <intel-gfx@...ts.freedesktop.org>,
        LKML <linux-kernel@...r.kernel.org>,
        dri-devel <dri-devel@...ts.freedesktop.org>,
        Pekka Paalanen <ppaalanen@...il.com>
Subject: Re: [Intel-gfx] drm_modes: signed integer overflow

On Thursday, October 22, 2020 12:14 PM, Ville Syrjälä <ville.syrjala@...ux.intel.com> wrote:

> On Wed, Oct 21, 2020 at 08:13:43PM -0700, Randy Dunlap wrote:
>
> > Hi,
> > With linux-next 20201021, when booting up, I am seeing this:
> > [ 0.560896] UBSAN: signed-integer-overflow in ../drivers/gpu/drm/drm_modes.c:765:20
> > [ 0.560903] 2376000 * 1000 cannot be represented in type 'int'
>
> Dang. Didn't realize these new crazy >8k modes have dotclocks reaching
> almost 6 GHz, which would overflow even u32. I guess we'll switch to
> 64bit maths. Now I wonder how many other places can hit this overflow
> in practice...

Can you provide an example of a full crazy >8k mode? I'm trying to get
a fix for my user-space [1], and I'm wondering if int32_t is enough
after dividing by mode->htotal.

CC Pekka, just FYI (I think Weston has similar code).

[1]: https://github.com/swaywm/wlroots/pull/2450