linux-kernel - Re: [PATCH] drm/msm/dpu: Fix bit-shifting UB in DPU_HW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f2ac0d80-fab1-8211-1dfe-cea078929e91@infradead.org>
Date:   Tue, 21 Mar 2023 08:08:28 -0700
From:   Randy Dunlap <rdunlap@...radead.org>
To:     Geert Uytterhoeven <geert+renesas@...der.be>,
        Rob Clark <robdclark@...il.com>,
        Abhinav Kumar <quic_abhinavk@...cinc.com>,
        Dmitry Baryshkov <dmitry.baryshkov@...aro.org>,
        Sean Paul <sean@...rly.run>, David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>, Vinod Koul <vkoul@...nel.org>,
        Konrad Dybcio <konrad.dybcio@...aro.org>,
        Bjorn Andersson <andersson@...nel.org>,
        Neil Armstrong <neil.armstrong@...aro.org>,
        Kuogee Hsieh <quic_khsieh@...cinc.com>
Cc:     linux-arm-msm@...r.kernel.org, dri-devel@...ts.freedesktop.org,
        freedreno@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/msm/dpu: Fix bit-shifting UB in DPU_HW_VER() macro



On 3/6/23 01:06, Geert Uytterhoeven wrote:
> With gcc-5 and CONFIG_UBSAN_SHIFT=y:
> 
>     drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable':
>     drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant
>       case DPU_HW_VER_800:
>       ^
>     drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant
>       case DPU_HW_VER_810:
>       ^
>     drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant
>       case DPU_HW_VER_900:
>       ^
> 
> This happens because for major revisions 8 or greather, the non-sign bit
> of the major revision number is shifted into bit 31 of a signed integer,
> which is undefined behavior.
> 
> Fix this by casting the major revision number to unsigned int.
> 
> Fixes: efcd0107727c4f04 ("drm/msm/dpu: add support for SM8550")
> Fixes: 4a352c2fc15aec1e ("drm/msm/dpu: Introduce SC8280XP")
> Fixes: 100d7ef6995d1f86 ("drm/msm/dpu: add support for SM8450")
> Signed-off-by: Geert Uytterhoeven <geert+renesas@...der.be>

Reviewed-by: Randy Dunlap <rdunlap@...radead.org>

Thanks.

> ---
>  drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
> index ddab9caebb18c40d..bbd3cbdd77956c5d 100644
> --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
> +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
> @@ -19,8 +19,9 @@
>   */
>  #define MAX_BLOCKS    12
>  
> -#define DPU_HW_VER(MAJOR, MINOR, STEP) (((MAJOR & 0xF) << 28)    |\
> -		((MINOR & 0xFFF) << 16)  |\
> +#define DPU_HW_VER(MAJOR, MINOR, STEP)			\
> +		((((unsigned int)MAJOR & 0xF) << 28) |	\
> +		((MINOR & 0xFFF) << 16) |		\
>  		(STEP & 0xFFFF))
>  
>  #define DPU_HW_MAJOR(rev)		((rev) >> 28)

-- 
~Randy