lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <ZttRSCOFSjT89Gxk@intel.com> Date: Fri, 6 Sep 2024 15:00:24 -0400 From: Rodrigo Vivi <rodrigo.vivi@...el.com> CC: Jani Nikula <jani.nikula@...ux.intel.com>, Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>, Tvrtko Ursulin <tursulin@...ulin.net>, David Airlie <airlied@...il.com>, Daniel Vetter <daniel@...ll.ch>, <intel-gfx@...ts.freedesktop.org>, <dri-devel@...ts.freedesktop.org>, <linux-kernel@...r.kernel.org>, <lvc-project@...uxtesting.org>, <stable@...r.kernel.org> Subject: Re: [PATCH] drm/i915/guc: prevent a possible int overflow in wq offsets On Thu, Jul 25, 2024 at 08:59:25AM -0700, Nikita Zhandarovich wrote: > It may be possible for the sum of the values derived from > i915_ggtt_offset() and __get_parent_scratch_offset()/ > i915_ggtt_offset() to go over the u32 limit before being assigned > to wq offsets of u64 type. > > Mitigate these issues by expanding one of the right operands > to u64 to avoid any overflow issues just in case. > > Found by Linux Verification Center (linuxtesting.org) with static > analysis tool SVACE. > > Fixes: 2584b3549f4c ("drm/i915/guc: Update to GuC version 70.1.1") this is not the correct fixes tag. The code is like this since Fixes: c2aa552ff09d ("drm/i915/guc: Add multi-lrc context registration") Cc: Matthew Brost <matthew.brost@...el.com> Cc: John Harrison <John.C.Harrison@...el.com> Also, this is theoretical only since I don't believe it is actually possible like Tvrtko had mentioned already. But let's give a piece of mind to the static analyzers and get this in. Reviewed-by: Rodrigo Vivi <rodrigo.vivi@...el.com> (pushing now with the fixes fixes tag) > Cc: stable@...r.kernel.org > Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru> > --- > drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c > index 9400d0eb682b..908ebfa22933 100644 > --- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c > +++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c > @@ -2842,9 +2842,9 @@ static void prepare_context_registration_info_v70(struct intel_context *ce, > ce->parallel.guc.wqi_tail = 0; > ce->parallel.guc.wqi_head = 0; > > - wq_desc_offset = i915_ggtt_offset(ce->state) + > + wq_desc_offset = (u64)i915_ggtt_offset(ce->state) + > __get_parent_scratch_offset(ce); > - wq_base_offset = i915_ggtt_offset(ce->state) + > + wq_base_offset = (u64)i915_ggtt_offset(ce->state) + > __get_wq_offset(ce); > info->wq_desc_lo = lower_32_bits(wq_desc_offset); > info->wq_desc_hi = upper_32_bits(wq_desc_offset);
Powered by blists - more mailing lists