Subject: Re: [PATCH] iommu/vt-d: Fix shift overflow in qi_flush_dev_iotlb
To: Alex Williamson <alex.williamson@redhat.com>,
        Peter Xu <peterx@redhat.com>
Cc: iommu@lists.linux-foundation.org, dwmw2@infradead.org,
        linux-kernel@vger.kernel.org, tursulin@ursulin.net
References: <20171212224250.22173.74201.stgit@gimli.home>
 <20171213071355.GD7780@xz-mi> <20171213085847.3d3245c6@t450s.home>
From: "Hook, Gary" <ghook@amd.com>
Message-ID: <ae778a81-a500-d8d2-5c7e-10630fe42734@amd.com>
Date: Wed, 13 Dec 2017 10:41:47 -0600
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <20171213085847.3d3245c6@t450s.home>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Dec 2017 16:41:50.8084 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: f3c8d766-ec1b-4d23-db88-08d54248694e
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR12MB1212
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 1569
Lines: 45

On 12/13/2017 9:58 AM, Alex Williamson wrote:
> On Wed, 13 Dec 2017 15:13:55 +0800
> Peter Xu <peterx@redhat.com> wrote:
> 
>> On Tue, Dec 12, 2017 at 03:43:08PM -0700, Alex Williamson wrote:
>>
>> [...]
>>
>>> diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
>>> index 9a7ffd13c7f0..87888b102057 100644
>>> --- a/drivers/iommu/dmar.c
>>> +++ b/drivers/iommu/dmar.c
>>> @@ -1345,7 +1345,9 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep,
>>>   	struct qi_desc desc;
>>>   
>>>   	if (mask) {
>>> -		BUG_ON(addr & ((1 << (VTD_PAGE_SHIFT + mask)) - 1));
>>> +		BUG_ON((mask > MAX_AGAW_PFN_WIDTH) ||
>>> +		       ((mask == MAX_AGAW_PFN_WIDTH) && addr) ||
>>> +		       (addr & ((1 << (VTD_PAGE_SHIFT + mask)) - 1)));
>>
>> Could it work if we just use 1ULL instead of 1 here?  Thanks,
> 
> In either case we're talking about shifting off the end of the
> variable, which I understand to be undefined.  Right?  Thanks,

How so? Bits fall off the left (MSB) end, zeroes fill in the right (LSB) 
end. I believe that behavior is pretty set.

The only problem here is that the promotion of integral types is (at the 
very least) unclear in this statement. As for the proposal, do we know 
that 1ULL is always going to be the same size as addr?

I would suggest, as pedantic as it sounds, creating a local u64 
variable, initialized to 1, and using that in the BUG_ON:

	u64 ubit = 1;

	...

  	if (mask) {
		BUG_ON(addr & ((ubit << (VTD_PAGE_SHIFT + mask)) - 1));

I believe this forces everything to be appropriately wide, and the same 
size?