Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.32 as permitted sender) client-ip=23.128.96.32;
From:   Donald Robson <donald.robson@imgtec.com>
To:     <dri-devel@lists.freedesktop.org>, <linux-kernel@vger.kernel.org>
CC:     <frank.binns@imgtec.com>, <donald.robson@imgtec.com>,
        <matt.coster@imgtec.com>, <maarten.lankhorst@linux.intel.com>,
        <mripard@kernel.org>, <tzimmermann@suse.de>, <airlied@gmail.com>,
        <daniel@ffwll.ch>, Dan Carpenter <dan.carpenter@linaro.org>
Subject: [PATCH] drm/imagination: Fixed infinite loop in pvr_vm_mips_map()
Date:   Fri,  8 Dec 2023 16:08:25 +0000
Message-Id: <20231208160825.92933-1-donald.robson@imgtec.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?13WQxwHcFeeBaF3CSjBbrfJOah947NNsqpInR3BTV+iCLq2okek9d3YiioTM?=
 =?us-ascii?Q?Et1FeyEWXrFas5hF9BOszFJ+qc4G2vKa61yLfuMD8Nc+ujzQ5wk9hyZoR/2a?=
 =?us-ascii?Q?oGLXNvVz8mLRCzcK9Y50uXIA72kckTUWrE6Dy2JrYI2eOVwZ7DpMu+xRTMhn?=
 =?us-ascii?Q?oUXwUkmIV9ITWQQ9mFGa5aHIHxVAkikORI8fOMg04sW+AJTvL4gxWSBbxNvr?=
 =?us-ascii?Q?Fluu8dO999N2FrGqSfVshdtq4KKx9VuSACoavo8aKvfd0A3ZKKL7HqXNU0Ub?=
 =?us-ascii?Q?XSBBmnemhODCKIUW8HHjtCU5vLaHnNkVkzb72EyEyL13Lqt8BOzUg81jYPtV?=
 =?us-ascii?Q?G4QKWNCEojlb3wa8C9wvsJK2jEXP13g1EQtOj10Odv0LmLZcgKuUzHX4NAem?=
 =?us-ascii?Q?I/sI8g5bgQ8abwW1/KSJlENiVCDmwztdL0/pHQQ2/1f658imwrVtH83ErpEz?=
 =?us-ascii?Q?PWdb/djLNvyev0AgPxNq0C2xSHUvJErAREMtFAIGf5YDOJejvqPENLMUnFhE?=
 =?us-ascii?Q?pGN8Xsp3V4ijalNcBA89ZYnIdld3aLxFEgpmf2jV9v4x5NUZogYuW5Flzs8s?=
 =?us-ascii?Q?okZKgmxmVgJaGOJFerYFo9Xi23hmzP1YIbC8zIxef56PUpyoVjfe51gR23/y?=
 =?us-ascii?Q?W+BsgGgRbrqiPEoCkklpW7+TWUfNpMBqgm1K8zfs/st4KD8B68f6ppKkSamy?=
 =?us-ascii?Q?RdRBPTzKzl9XTP3rqH1okTuSNtIN6ZO2TEP6Y7BsGBmUFWCAxoBE2BZiKxNd?=
 =?us-ascii?Q?EI1qNN1A06yJNt3Qbgwea161+2dJB/gjNT1HpD1ScTExf37GGHTe6FWopeSY?=
 =?us-ascii?Q?sU1+nINbx2JaR9tbj2QW+kUPwV6B8tNwPEZfzkuRK+KnGjhpqjZkuKo86fd5?=
 =?us-ascii?Q?OOGqCtait6WFR9LE1IPeAy21LCyCTzvvK1l92gtvIXMmNBco0mRofhfgDvSp?=
 =?us-ascii?Q?D1WohcJao0EULRyiSwbtPhzh1bMNmKf3J8yGn80Byzj+7qUnxaQzdUhiqcTT?=
 =?us-ascii?Q?s/VnV9keXabqolYsmTFriz8ui5RCNIzkhYpyqPIKekOEgNe9NxZUdqaP1xFn?=
 =?us-ascii?Q?J8d1NjAvlJ2NU7AQE6o0zGmBS6qoGpKUaZ3AtJfeLF3Db/S9rgpqzHVYYG0W?=
 =?us-ascii?Q?O8J9Ele+z3fSG8uMaYqOoh5rjHIvYbxZWpMoCKz4/O1WTzM4fckm7cWBokBo?=
 =?us-ascii?Q?90cUrFfiGk5izLBTN3x5a30T6RvZdJaJexQAlZ6mKLY2ZyRlp3uEQm1j8IKJ?=
 =?us-ascii?Q?1C0CPZlQkV5DlXExdCf4yWR8OyYmjgBtfzHRtKZvu8cddKQ2SKdUsLVsafEa?=
 =?us-ascii?Q?IfdiEKm8Ep+180ZCozbhMs3Q2ysGpgp8AWZitKTM6zOytEps0NNBCwWpv8hP?=
 =?us-ascii?Q?QrCHO+kcD487zEUcmIYAE9uWZCvpe+A9vVP9bxDa4Chs65GBPac/BNrO/IiO?=
 =?us-ascii?Q?r9Qjy6CoYcfoSg3I90jJvq4ITDX36/1vl+9wkMomjmrexDplELeUT7ckCPTr?=
 =?us-ascii?Q?ZnFOFwu46w5QB6Lnfi+eCK+XJhEIG/e0j9h6Vncs6bvRBAKl5ar5Q127i18R?=
 =?us-ascii?Q?Lrb900bJBso1A4rpbiKEH7k3WMm+CY0DMWf4cpzDPWfjGuD/xVIu0XuWyN63?=
 =?us-ascii?Q?qw=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: aa37c0bf-e381-462b-c6e0-08dbf807f18f
X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB4600.GBRP265.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Dec 2023 16:08:40.5463
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 0d5fd8bb-e8c2-4e0a-8dd5-2c264f7140fe
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: pRDTk/aWDcHKG0PBnRUyFBRC3QrPuHg7VBhK0ygv1uERSozM3QDOqvQ93woprpudDjRhWLhxLEmAC0cXAChawJv9rAww5KblA7qAfXHgyXs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P265MB6228
X-OriginatorOrg: imgtec.com
X-EXCLAIMER-MD-CONFIG: 15a78312-3e47-46eb-9010-2e54d84a9631
X-Proofpoint-GUID: 0xZeGb7dLckUgYh16dTydqZzT57u3B1u
X-Proofpoint-ORIG-GUID: 0xZeGb7dLckUgYh16dTydqZzT57u3B1u
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Fri, 08 Dec 2023 08:10:15 -0800 (PST)

Unwinding loop in error path for this function uses unsigned limit
variable, causing the promotion of the signed counter variable.

--> 204         for (; pfn >= start_pfn; pfn--)
                       ^^^^^^^^^^^^^^^^
If start_pfn can be zero then this is an endless loop.  I've seen this
code in other places as well.  This loop is slightly off as well.  It
should decrement pfn on the first iteration.

Fix by making the loop limit variables signed. Also fix missing
predecrement by modifying to while loop.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Donald Robson <donald.robson@imgtec.com>
---
 drivers/gpu/drm/imagination/pvr_vm_mips.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/imagination/pvr_vm_mips.c b/drivers/gpu/drm/imagination/pvr_vm_mips.c
index 2bc7181a4c3e..b7fef3c797e6 100644
--- a/drivers/gpu/drm/imagination/pvr_vm_mips.c
+++ b/drivers/gpu/drm/imagination/pvr_vm_mips.c
@@ -152,8 +152,8 @@ pvr_vm_mips_map(struct pvr_device *pvr_dev, struct pvr_fw_object *fw_obj)
 	u64 end;
 	u32 cache_policy;
 	u32 pte_flags;
-	u32 start_pfn;
-	u32 end_pfn;
+	s32 start_pfn;
+	s32 end_pfn;
 	s32 pfn;
 	int err;
 
@@ -201,7 +201,7 @@ pvr_vm_mips_map(struct pvr_device *pvr_dev, struct pvr_fw_object *fw_obj)
 	return 0;
 
 err_unmap_pages:
-	for (; pfn >= start_pfn; pfn--)
+	while (--pfn >= start_pfn)
 		WRITE_ONCE(mips_data->pt[pfn], 0);
 
 	pvr_mmu_flush_request_all(pvr_dev);
-- 
2.25.1