linux-kernel - [PATCH][next] RDMA/irdma: Fix issues with u8 left shift operation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat,  5 Jun 2021 13:20:59 +0100
From:   Colin King <colin.king@...onical.com>
To:     Mustafa Ismail <mustafa.ismail@...el.com>,
        Shiraz Saleem <shiraz.saleem@...el.com>,
        Doug Ledford <dledford@...hat.com>,
        Jason Gunthorpe <jgg@...pe.ca>, linux-rdma@...r.kernel.org
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH][next] RDMA/irdma: Fix issues with u8 left shift operation

From: Colin Ian King <colin.king@...onical.com>

The shifting of the u8 integer info->map[i] the left will be promoted
to a 32 bit signed int and then sign-extended to a u64. In the event
that the top bit of the u8 is set then all then all the upper 32 bits
of the u64 end up as also being set because of the sign-extension.
Fix this by casting the u8 values to a u64 before the left shift. This

Addresses-Coverity: ("Unitentional integer overflow / bad shift operation")
Fixes: 3f49d6842569 ("RDMA/irdma: Implement HW Admin Queue OPs")
Signed-off-by: Colin Ian King <colin.king@...onical.com>
---
 drivers/infiniband/hw/irdma/ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/irdma/ctrl.c b/drivers/infiniband/hw/irdma/ctrl.c
index 5aa112067bce..8bd3aecadaf6 100644
--- a/drivers/infiniband/hw/irdma/ctrl.c
+++ b/drivers/infiniband/hw/irdma/ctrl.c
@@ -2157,7 +2157,7 @@ static enum irdma_status_code irdma_sc_set_up_map(struct irdma_sc_cqp *cqp,
 		return IRDMA_ERR_RING_FULL;
 
 	for (i = 0; i < IRDMA_MAX_USER_PRIORITY; i++)
-		temp |= info->map[i] << (i * 8);
+		temp |= (u64)info->map[i] << (i * 8);
 
 	set_64bit_val(wqe, 0, temp);
 	set_64bit_val(wqe, 40,
-- 
2.31.1