Received: by 2002:a05:6902:102b:0:0:0:0 with SMTP id x11csp1380665ybt; Thu, 18 Jun 2020 07:26:14 -0700 (PDT) X-Google-Smtp-Source: ABdhPJz0wj4lJoU6yk6E+EUVPgcyGVwcHmVf9iIUrQgaDgaml69KdXeueOcQDMkYabILQnL6i4Nw X-Received: by 2002:a17:906:495a:: with SMTP id f26mr3987871ejt.329.1592490374386; Thu, 18 Jun 2020 07:26:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1592490374; cv=none; d=google.com; s=arc-20160816; b=MwZe6VIo2E6e2F9fBG7W5Ec2/kVPDg3yjnkC2pAtTMwpABo8HI4ilBKM7WWYK9Ty9w HOG2zQUob9cO/lPsGcCBX/bBNB1+OiSOtSeQqil777bJ72qgCYzk1w1vxf1U6R9CJ18Y pwC08d/mHDXkkwxyefHimF/zqgTSpHF/i1HFjfCBQnydW/wL3YpA09VQIF0f313+NdLV R9fHFq/tEJbfOwrHJOf6o3q0vCWefBSLSIktJ2VFsO1WAz5kCnfMB+pbTFjFXMz5ezqy dLK/9QuqG616M6z69xyV/jWaz3iJDMRaKHrqYh96D+7oROVl6DVaOe45sczXJWpow0gb 4xUg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:content-transfer-encoding :content-disposition:mime-version:references:message-id:subject:cc :to:from:date; bh=dm4ExWWS/xTqnqiwpOkQvv/KbWOrYTjVBTXSSf9KXFI=; b=vkpiLgqJg1QwhxC7E2lQ19O0BxyIrPczTtO7PH7QjDLKqXkw0mdomD5+42oh5PLxCZ xaJ6z7vLS/BFlh9BEvjlce/OhabmbtsqBxYJZkgMCHsjmefDa5rOeoKUzY/2o1hFZTTI GxfyNZznr2komUu8QfMn0EnAPK6CWmwb4GIcJV3Y/r+NAkmhnAlEu46p2kvLfvv9esW4 FZH0Ia5auggLIX2zDWR/gMmmvCoRhGG+YilFwxbNtfye3FBOGj5eUl/Y5HDeQSvqfO2Z SosxCuzG/YrlVaUoHqkeX2gC+SPd6hpfxcPGtajyWk39reu/2Kp8Wxps05tRYtk9Fo+c SPLw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id jt19si1766457ejb.389.2020.06.18.07.25.50; Thu, 18 Jun 2020 07:26:14 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730476AbgFROVJ (ORCPT + 99 others); Thu, 18 Jun 2020 10:21:09 -0400 Received: from foss.arm.com ([217.140.110.172]:51018 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727078AbgFROVI (ORCPT ); Thu, 18 Jun 2020 10:21:08 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 0D4B2101E; Thu, 18 Jun 2020 07:21:08 -0700 (PDT) Received: from e110455-lin.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id E1CDE3F6CF; Thu, 18 Jun 2020 07:21:07 -0700 (PDT) Received: by e110455-lin.cambridge.arm.com (Postfix, from userid 1000) id AB6D7682B9C; Thu, 18 Jun 2020 15:21:06 +0100 (BST) Date: Thu, 18 Jun 2020 15:21:06 +0100 From: Liviu Dudau To: Colin Ian King Cc: David Airlie , kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH] drm/arm: fix unintentional integer overflow on left shift Message-ID: <20200618142106.GK159988@e110455-lin.cambridge.arm.com> References: <20200618100400.11464-1-colin.king@canonical.com> <20200618121405.GJ159988@e110455-lin.cambridge.arm.com> <5d08fbec-75d8-d9a9-af61-e6ab98e77c80@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <5d08fbec-75d8-d9a9-af61-e6ab98e77c80@canonical.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jun 18, 2020 at 01:50:34PM +0100, Colin Ian King wrote: > On 18/06/2020 13:14, Liviu Dudau wrote: > > On Thu, Jun 18, 2020 at 11:04:00AM +0100, Colin King wrote: > >> From: Colin Ian King > > > > Hi Colin, > > > >> > >> Shifting the integer value 1 is evaluated using 32-bit arithmetic > >> and then used in an expression that expects a long value leads to > >> a potential integer overflow. > > > > I'm afraid this explanation makes no sense to me. Do you care to explain better what > > you think the issue is? If the shift is done as 32-bit arithmetic and then promoted > > to long how does the overflow happen? > > The shift is performed using 32 bit signed math and then assigned to an > unsigned 64 bit long. This if the shift is 31 bits then the signed int > conversion of 0x80000000 to unsigned long becomes 0xffffffff80000000. > If the shift is more than 32 bits then result overflows and becomes 0x0. You are right, I've missed the fact that it is signed math. Not very likely that we are going to ever have 30 or more CRTCs in the driver, but Coverity has no way of knowing that. Acked-by: Liviu Dudau I will pull this into drm-misc-next today. Best regards, Liviu > > Colin > > > > > Best regards, > > Liviu > > > >> Fix this by using the BIT macro to > >> perform the shift to avoid the overflow. > >> > >> Addresses-Coverity: ("Unintentional integer overflow") > >> Fixes: ad49f8602fe8 ("drm/arm: Add support for Mali Display Processors") > >> Signed-off-by: Colin Ian King > >> --- > >> drivers/gpu/drm/arm/malidp_planes.c | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > >> > >> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c > >> index 37715cc6064e..ab45ac445045 100644 > >> --- a/drivers/gpu/drm/arm/malidp_planes.c > >> +++ b/drivers/gpu/drm/arm/malidp_planes.c > >> @@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm) > >> const struct malidp_hw_regmap *map = &malidp->dev->hw->map; > >> struct malidp_plane *plane = NULL; > >> enum drm_plane_type plane_type; > >> - unsigned long crtcs = 1 << drm->mode_config.num_crtc; > >> + unsigned long crtcs = BIT(drm->mode_config.num_crtc); > >> unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 | > >> DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y; > >> unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) | > >> -- > >> 2.27.0.rc0 > >> > > > > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/dri-devel -- ==================== | I would like to | | fix the world, | | but they're not | | giving me the | \ source code! / --------------- ¯\_(ツ)_/¯