netdev - Re: [PATCH] net: lio_core: fix potential sign-extension overflow on large shift

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 17 Jun 2019 19:06:09 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Colin King <colin.king@...onical.com>
Cc:     Derek Chickles <dchickles@...vell.com>,
        Satanand Burla <sburla@...vell.com>,
        Felix Manlunas <fmanlunas@...vell.com>,
        "David S . Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
        kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: lio_core: fix potential sign-extension overflow on
 large shift

On Mon, Jun 17, 2019 at 04:53:25PM +0100, Colin King wrote:
> From: Colin Ian King <colin.king@...onical.com>
> 
> Left shifting the signed int value 1 by 31 bits has undefined behaviour
> and the shift amount oq_no can be as much as 63.  Fix this by widening
> the int 1 to 1ULL.
> 
> Addresses-Coverity: ("Bad shift operation")
> Fixes: f21fb3ed364b ("Add support of Cavium Liquidio ethernet adapters")
> Signed-off-by: Colin Ian King <colin.king@...onical.com>
> ---
>  drivers/net/ethernet/cavium/liquidio/lio_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/cavium/liquidio/lio_core.c b/drivers/net/ethernet/cavium/liquidio/lio_core.c
> index 1c50c10b5a16..e78bdcee200f 100644
> --- a/drivers/net/ethernet/cavium/liquidio/lio_core.c
> +++ b/drivers/net/ethernet/cavium/liquidio/lio_core.c
> @@ -964,7 +964,7 @@ static void liquidio_schedule_droq_pkt_handlers(struct octeon_device *oct)
>  
>  			if (droq->ops.poll_mode) {
>  				droq->ops.napi_fn(droq);
> -				oct_priv->napi_mask |= (1 << oq_no);
> +				oct_priv->napi_mask |= (1ULL << oq_no);

The function uses BIT_ULL(oq_no) earlier, so we should probably do the
same here.

regards,
dan carpenter