linux-kernel - [PATCH v2] irqchip/xilinx: Fix shift out of bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1723186944-3571957-1-git-send-email-radhey.shyam.pandey@amd.com>
Date: Fri, 9 Aug 2024 12:32:24 +0530
From: Radhey Shyam Pandey <radhey.shyam.pandey@....com>
To: <tglx@...utronix.de>, <michal.simek@....com>
CC: <linux-kernel@...r.kernel.org>, <linux-arm-kernel@...ts.infradead.org>,
	<git@....com>, Radhey Shyam Pandey <radhey.shyam.pandey@....com>
Subject: [PATCH v2] irqchip/xilinx: Fix shift out of bounds

The device tree property 'xlnx,kind-of-intr' sanity checked that
the bitmask contains only set bits which are in the range of the
number of interrupts supported by the controller.

The check is done by shifting the mask right by the number of
supported interrupts and checking the result for zero.

The data type of the mask is u32 and the number of supported
interrupts is up to 32. In case of 32 interrupts the shift is out of
bounds, resulting in a mismatch warning. The out of bounds condition
is also reported by UBSAN.

UBSAN: shift-out-of-bounds in irq-xilinx-intc.c:332:22
shift exponent 32 is too large for 32-bit type 'unsigned int'

Fix it by promoting the mask to u64 for the test.

Fixes: d50466c90724 ("microblaze: intc: Refactor DT sanity check")
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@....com>
---
Changes for v2:
Rephrase one line summary and commit description as suggested by
Thomas Gleixner.
---
 drivers/irqchip/irq-xilinx-intc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-xilinx-intc.c b/drivers/irqchip/irq-xilinx-intc.c
index 238d3d344949..7e08714d507f 100644
--- a/drivers/irqchip/irq-xilinx-intc.c
+++ b/drivers/irqchip/irq-xilinx-intc.c
@@ -189,7 +189,7 @@ static int __init xilinx_intc_of_init(struct device_node *intc,
 		irqc->intr_mask = 0;
 	}
 
-	if (irqc->intr_mask >> irqc->nr_irq)
+	if ((u64)irqc->intr_mask >> irqc->nr_irq)
 		pr_warn("irq-xilinx: mismatch in kind-of-intr param\n");
 
 	pr_info("irq-xilinx: %pOF: num_irq=%d, edge=0x%x\n",

base-commit: ee9a43b7cfe2d8a3520335fea7d8ce71b8cabd9d
-- 
2.34.1