linux-kernel - [PATCH] interconnect: qcom: msm8974: Prevent integer overflow in rate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201106144847.7726-1-georgi.djakov@linaro.org>
Date:   Fri,  6 Nov 2020 16:48:47 +0200
From:   Georgi Djakov <georgi.djakov@...aro.org>
To:     linux-pm@...r.kernel.org, luca@...tu.xyz, masneyb@...tation.org
Cc:     bjorn.andersson@...aro.org, saravanak@...gle.com,
        linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org,
        Georgi Djakov <georgi.djakov@...aro.org>
Subject: [PATCH] interconnect: qcom: msm8974: Prevent integer overflow in rate

When sync_state support got introduced recently, by default we try to
set the NoCs to run initially at maximum rate. But as these values are
aggregated, we may end with a really big clock rate value, which is
then converted from "u64" to "long" during the clock rate rounding.
But on 32bit platforms this may result an overflow. Fix it by making
sure that the rate is within range.

Reported-by: Luca Weiss <luca@...tu.xyz>
Fixes: b1d681d8d324 ("interconnect: Add sync state support")
Signed-off-by: Georgi Djakov <georgi.djakov@...aro.org>
---
 drivers/interconnect/qcom/msm8974.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/interconnect/qcom/msm8974.c b/drivers/interconnect/qcom/msm8974.c
index 3a313e11e73d..b6b639dad691 100644
--- a/drivers/interconnect/qcom/msm8974.c
+++ b/drivers/interconnect/qcom/msm8974.c
@@ -618,6 +618,8 @@ static int msm8974_icc_set(struct icc_node *src, struct icc_node *dst)
 
 	do_div(rate, src_qn->buswidth);
 
+	rate = min_t(u32, rate, INT_MAX);
+
 	if (src_qn->rate == rate)
 		return 0;
 
@@ -758,6 +760,7 @@ static struct platform_driver msm8974_noc_driver = {
 	.driver = {
 		.name = "qnoc-msm8974",
 		.of_match_table = msm8974_noc_of_match,
+		.sync_state = icc_sync_state,
 	},
 };
 module_platform_driver(msm8974_noc_driver);