2012-05-28 12:29:25

by Zhenzhong Duan

Subject: [PATCH] Fix an overflow in range_to_mtrr func

When boot x86_64 kernel on sun G5+ with 4T mem, see an overflow in mtrr cleanup as below.

*BAD*gran_size: 2G chunk_size: 2G num_reg: 10 lose cover RAM:
-18014398505283592M

This is because 1<<31 sign extended.
Use explicit type conversion to force a 64bit constant to fix it.
Useful for mem larger than or equal to 4T.

Signed-off-by: Zhenzhong Duan <[email protected]>
---
arch/x86/kernel/cpu/mtrr/cleanup.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
index ac140c7..853a4c6 100644
--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
+++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
@@ -266,7 +266,7 @@ range_to_mtrr(unsigned int reg, unsigned long range_startk,
if (align > max_align)
align = max_align;

- sizek = 1 << align;
+ sizek = (unsigned long)1 << align;
if (debug_print) {
char start_factor = 'K', size_factor = 'K';
unsigned long start_base, size_base;
--
1.7.3

2012-05-29 17:18:45

by Yinghai Lu

Subject: Re: [PATCH] Fix an overflow in range_to_mtrr func

On Mon, May 28, 2012 at 5:29 AM, Zhenzhong Duan
<[email protected]> wrote:
> When boot x86_64 kernel on sun G5+ with 4T mem, see an overflow in mtrr cleanup as below.
>
> *BAD*gran_size: 2G ? ? ?chunk_size: 2G ?num_reg: 10 ? ? lose cover RAM:
> -18014398505283592M
>
> This is because 1<<31 sign extended.
> Use explicit type conversion to force a 64bit constant to fix it.
> Useful for mem larger than or equal to 4T.
>
> Signed-off-by: Zhenzhong Duan <[email protected]>
> ---
> ?arch/x86/kernel/cpu/mtrr/cleanup.c | ? ?2 +-
> ?1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
> index ac140c7..853a4c6 100644
> --- a/arch/x86/kernel/cpu/mtrr/cleanup.c
> +++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
> @@ -266,7 +266,7 @@ range_to_mtrr(unsigned int reg, unsigned long range_startk,
> ? ? ? ? ? ? ? ?if (align > max_align)
> ? ? ? ? ? ? ? ? ? ? ? ?align = max_align;
>
> - ? ? ? ? ? ? ? sizek = 1 << align;
> + ? ? ? ? ? ? ? sizek = (unsigned long)1 << align;

how about

sizek = 1UL << align;


> ? ? ? ? ? ? ? ?if (debug_print) {
> ? ? ? ? ? ? ? ? ? ? ? ?char start_factor = 'K', size_factor = 'K';
> ? ? ? ? ? ? ? ? ? ? ? ?unsigned long start_base, size_base;
> --
> 1.7.3
>

2012-05-30 04:52:02

by Zhenzhong Duan

Subject: [PATCH v2] Fix an overflow in range_to_mtrr func

When boot on sun G5+ with 4T mem, see an overflow in mtrr cleanup as below.

*BAD*gran_size: 2G chunk_size: 2G num_reg: 10 lose cover RAM:
-18014398505283592M

This is because 1<<31 sign extended. Use 64bit constant to fix it.
Useful for mem larger than or equal to 4T.

-v2: Use 64bit constant instead of explicit type conversion as suggested
by Yinghai. Description updated too.

Signed-off-by: Zhenzhong Duan <[email protected]>
---
arch/x86/kernel/cpu/mtrr/cleanup.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c
b/arch/x86/kernel/cpu/mtrr/cleanup.c
index ac140c7..853a4c6 100644
--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
+++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
@@ -266,7 +266,7 @@ range_to_mtrr(unsigned int reg, unsigned long
range_startk,
if (align > max_align)
align = max_align;

- sizek = 1 << align;
+ sizek = 1UL << align;
if (debug_print) {
char start_factor = 'K', size_factor = 'K';
unsigned long start_base, size_base;
-- 1.7.3

2012-05-30 23:23:04

by Zhenzhong Duan

Subject: [tip:x86/urgent] x86, mtrr: Fix a type overflow in range_to_mtrr func

Commit-ID: 2da06af8106f8f35318bb084baf8448797ef058a
Gitweb: http://git.kernel.org/tip/2da06af8106f8f35318bb084baf8448797ef058a
Author: zhenzhong.duan <[email protected]>
AuthorDate: Wed, 30 May 2012 12:52:15 +0800
Committer: H. Peter Anvin <[email protected]>
CommitDate: Wed, 30 May 2012 14:37:00 -0700

x86, mtrr: Fix a type overflow in range_to_mtrr func

When boot on sun G5+ with 4T mem, see an overflow in mtrr cleanup as below.

*BAD*gran_size: 2G chunk_size: 2G num_reg: 10 lose cover RAM:
-18014398505283592M

This is because 1<<31 sign extended. Use an unsigned long constant to
fix it. Useful for mem larger than or equal to 4T.

-v2: Use 64bit constant instead of explicit type conversion as suggested
by Yinghai. Description updated too.

Signed-off-by: Zhenzhong Duan <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: H. Peter Anvin <[email protected]>
---
arch/x86/kernel/cpu/mtrr/cleanup.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
index ac140c7..bdda2e6 100644
--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
+++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
@@ -266,7 +266,7 @@ range_to_mtrr(unsigned int reg, unsigned long range_startk,
if (align > max_align)
align = max_align;

- sizek = 1 << align;
+ sizek = 1UL << align;
if (debug_print) {
char start_factor = 'K', size_factor = 'K';
unsigned long start_base, size_base;