linux-kernel - Re: [Intel-gfx] drm_modes: signed integer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 23 Oct 2020 18:27:19 +0300
From:   Ville Syrjälä <ville.syrjala@...ux.intel.com>
To:     Simon Ser <contact@...rsion.fr>
Cc:     Randy Dunlap <rdunlap@...radead.org>,
        David Airlie <airlied@...ux.ie>,
        intel-gfx <intel-gfx@...ts.freedesktop.org>,
        LKML <linux-kernel@...r.kernel.org>,
        dri-devel <dri-devel@...ts.freedesktop.org>,
        Pekka Paalanen <ppaalanen@...il.com>
Subject: Re: [Intel-gfx] drm_modes: signed integer overflow

On Fri, Oct 23, 2020 at 03:14:20PM +0000, Simon Ser wrote:
> On Thursday, October 22, 2020 12:14 PM, Ville Syrjälä <ville.syrjala@...ux.intel.com> wrote:
> 
> > On Wed, Oct 21, 2020 at 08:13:43PM -0700, Randy Dunlap wrote:
> >
> > > Hi,
> > > With linux-next 20201021, when booting up, I am seeing this:
> > > [ 0.560896] UBSAN: signed-integer-overflow in ../drivers/gpu/drm/drm_modes.c:765:20
> > > [ 0.560903] 2376000 * 1000 cannot be represented in type 'int'
> >
> > Dang. Didn't realize these new crazy >8k modes have dotclocks reaching
> > almost 6 GHz, which would overflow even u32. I guess we'll switch to
> > 64bit maths. Now I wonder how many other places can hit this overflow
> > in practice...
> 
> Can you provide an example of a full crazy >8k mode?

These are two extreme cases:
        /* 216 - 10240x4320@...Hz 64:27 */
        { DRM_MODE("10240x4320", DRM_MODE_TYPE_DRIVER, 5940000, 10240, 12432,
                   12608, 13200, 0, 4320, 4336, 4356, 4500, 0,
                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC),
          .picture_aspect_ratio = HDMI_PICTURE_ASPECT_64_27, },
        /* 217 - 10240x4320@...Hz 64:27 */
        { DRM_MODE("10240x4320", DRM_MODE_TYPE_DRIVER, 5940000, 10240, 10528,
                   10704, 11000, 0, 4320, 4336, 4356, 4500, 0,
                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC),
          .picture_aspect_ratio = HDMI_PICTURE_ASPECT_64_27, }

> I'm trying to get
> a fix for my user-space [1], and I'm wondering if int32_t is enough
> after dividing by mode->htotal.
> 
> CC Pekka, just FYI (I think Weston has similar code).
> 
> [1]: https://github.com/swaywm/wlroots/pull/2450

What's with those 1000000LL constants? Are you storing
clock in Hz units?

-- 
Ville Syrjälä
Intel