* [PATCH][next] perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
@ 2021-07-06 11:45 Colin King
2021-07-06 13:28 ` Liang, Kan
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Colin King @ 2021-07-06 11:45 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Mark Rutland, Alexander Shishkin, Jiri Olsa, Namhyung Kim,
Thomas Gleixner, Borislav Petkov, x86, H . Peter Anvin,
Kan Liang, linux-perf-users
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
The u32 variable pci_dword is being masked with 0x1fffffff and then left
shifted 23 places. The shift is a u32 operation,so a value of 0x200 or
more in pci_dword will overflow the u32 and only the bottow 32 bits
are assigned to addr. I don't believe this was the original intent.
Fix this by casting pci_dword to a resource_size_t to ensure no
overflow occurs.
Note that the mask and 12 bit left shift operation does not need this
because the mask SNR_IMC_MMIO_MEM0_MASK and shift is always a 32 bit
value.
Fixes: ee49532b38dd ("perf/x86/intel/uncore: Add IMC uncore support for Snow Ridge")
Addresses-Coverity: ("Unintentional integer overflow")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
arch/x86/events/intel/uncore_snbep.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 48419dad3b17..7518143850df 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -4827,7 +4827,7 @@ static int snr_uncore_mmio_map(struct intel_uncore_box *box,
return -ENODEV;
pci_read_config_dword(pdev, SNR_IMC_MMIO_BASE_OFFSET, &pci_dword);
- addr = (pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23;
+ addr = ((resource_size_t)pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23;
pci_read_config_dword(pdev, mem_offset, &pci_dword);
addr |= (pci_dword & SNR_IMC_MMIO_MEM0_MASK) << 12;
--
2.31.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH][next] perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
2021-07-06 11:45 [PATCH][next] perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32 Colin King
@ 2021-07-06 13:28 ` Liang, Kan
2021-07-27 13:58 ` [tip: perf/core] " tip-bot2 for Colin Ian King
2021-08-26 7:45 ` [tip: perf/urgent] " tip-bot2 for Colin Ian King
2 siblings, 0 replies; 4+ messages in thread
From: Liang, Kan @ 2021-07-06 13:28 UTC (permalink / raw)
To: Colin King, Peter Zijlstra, Ingo Molnar,
Arnaldo Carvalho de Melo, Mark Rutland, Alexander Shishkin,
Jiri Olsa, Namhyung Kim, Thomas Gleixner, Borislav Petkov, x86,
H . Peter Anvin, linux-perf-users
Cc: kernel-janitors, linux-kernel
On 7/6/2021 7:45 AM, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> The u32 variable pci_dword is being masked with 0x1fffffff and then left
> shifted 23 places. The shift is a u32 operation,so a value of 0x200 or
> more in pci_dword will overflow the u32 and only the bottow 32 bits
> are assigned to addr. I don't believe this was the original intent.
> Fix this by casting pci_dword to a resource_size_t to ensure no
> overflow occurs.
>
> Note that the mask and 12 bit left shift operation does not need this
> because the mask SNR_IMC_MMIO_MEM0_MASK and shift is always a 32 bit
> value.
>
> Fixes: ee49532b38dd ("perf/x86/intel/uncore: Add IMC uncore support for Snow Ridge")
> Addresses-Coverity: ("Unintentional integer overflow")
Thanks for the fix.
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Thanks,
Kan
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
> arch/x86/events/intel/uncore_snbep.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
> index 48419dad3b17..7518143850df 100644
> --- a/arch/x86/events/intel/uncore_snbep.c
> +++ b/arch/x86/events/intel/uncore_snbep.c
> @@ -4827,7 +4827,7 @@ static int snr_uncore_mmio_map(struct intel_uncore_box *box,
> return -ENODEV;
>
> pci_read_config_dword(pdev, SNR_IMC_MMIO_BASE_OFFSET, &pci_dword);
> - addr = (pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23;
> + addr = ((resource_size_t)pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23;
>
> pci_read_config_dword(pdev, mem_offset, &pci_dword);
> addr |= (pci_dword & SNR_IMC_MMIO_MEM0_MASK) << 12;
>
^ permalink raw reply [flat|nested] 4+ messages in thread* [tip: perf/core] perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
2021-07-06 11:45 [PATCH][next] perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32 Colin King
2021-07-06 13:28 ` Liang, Kan
@ 2021-07-27 13:58 ` tip-bot2 for Colin Ian King
2021-08-26 7:45 ` [tip: perf/urgent] " tip-bot2 for Colin Ian King
2 siblings, 0 replies; 4+ messages in thread
From: tip-bot2 for Colin Ian King @ 2021-07-27 13:58 UTC (permalink / raw)
To: linux-tip-commits
Cc: Colin Ian King, Peter Zijlstra (Intel), Kan Liang, x86, linux-kernel
The following commit has been merged into the perf/core branch of tip:
Commit-ID: 92279a3b11a0a8486ce6b92384ddc0849eb4060f
Gitweb: https://git.kernel.org/tip/92279a3b11a0a8486ce6b92384ddc0849eb4060f
Author: Colin Ian King <colin.king@canonical.com>
AuthorDate: Tue, 06 Jul 2021 12:45:53 +01:00
Committer: Peter Zijlstra <peterz@infradead.org>
CommitterDate: Fri, 16 Jul 2021 18:46:48 +02:00
perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
The u32 variable pci_dword is being masked with 0x1fffffff and then left
shifted 23 places. The shift is a u32 operation,so a value of 0x200 or
more in pci_dword will overflow the u32 and only the bottow 32 bits
are assigned to addr. I don't believe this was the original intent.
Fix this by casting pci_dword to a resource_size_t to ensure no
overflow occurs.
Note that the mask and 12 bit left shift operation does not need this
because the mask SNR_IMC_MMIO_MEM0_MASK and shift is always a 32 bit
value.
Fixes: ee49532b38dd ("perf/x86/intel/uncore: Add IMC uncore support for Snow Ridge")
Addresses-Coverity: ("Unintentional integer overflow")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Link: https://lore.kernel.org/r/20210706114553.28249-1-colin.king@canonical.com
---
arch/x86/events/intel/uncore_snbep.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index f665b16..9a178a9 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -4834,7 +4834,7 @@ static int snr_uncore_mmio_map(struct intel_uncore_box *box,
return -ENODEV;
pci_read_config_dword(pdev, SNR_IMC_MMIO_BASE_OFFSET, &pci_dword);
- addr = (pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23;
+ addr = ((resource_size_t)pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23;
pci_read_config_dword(pdev, mem_offset, &pci_dword);
addr |= (pci_dword & SNR_IMC_MMIO_MEM0_MASK) << 12;
^ permalink raw reply related [flat|nested] 4+ messages in thread* [tip: perf/urgent] perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
2021-07-06 11:45 [PATCH][next] perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32 Colin King
2021-07-06 13:28 ` Liang, Kan
2021-07-27 13:58 ` [tip: perf/core] " tip-bot2 for Colin Ian King
@ 2021-08-26 7:45 ` tip-bot2 for Colin Ian King
2 siblings, 0 replies; 4+ messages in thread
From: tip-bot2 for Colin Ian King @ 2021-08-26 7:45 UTC (permalink / raw)
To: linux-tip-commits
Cc: Colin Ian King, Peter Zijlstra (Intel),
Ingo Molnar, Kan Liang, x86, linux-kernel
The following commit has been merged into the perf/urgent branch of tip:
Commit-ID: 0b3a8738b76fe2087f7bc2bd59f4c78504c79180
Gitweb: https://git.kernel.org/tip/0b3a8738b76fe2087f7bc2bd59f4c78504c79180
Author: Colin Ian King <colin.king@canonical.com>
AuthorDate: Tue, 06 Jul 2021 12:45:53 +01:00
Committer: Ingo Molnar <mingo@kernel.org>
CommitterDate: Thu, 26 Aug 2021 08:58:02 +02:00
perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32
The u32 variable pci_dword is being masked with 0x1fffffff and then left
shifted 23 places. The shift is a u32 operation,so a value of 0x200 or
more in pci_dword will overflow the u32 and only the bottow 32 bits
are assigned to addr. I don't believe this was the original intent.
Fix this by casting pci_dword to a resource_size_t to ensure no
overflow occurs.
Note that the mask and 12 bit left shift operation does not need this
because the mask SNR_IMC_MMIO_MEM0_MASK and shift is always a 32 bit
value.
Fixes: ee49532b38dd ("perf/x86/intel/uncore: Add IMC uncore support for Snow Ridge")
Addresses-Coverity: ("Unintentional integer overflow")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Link: https://lore.kernel.org/r/20210706114553.28249-1-colin.king@canonical.com
---
arch/x86/events/intel/uncore_snbep.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 609c24a..c682b09 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -4811,7 +4811,7 @@ static void __snr_uncore_mmio_init_box(struct intel_uncore_box *box,
return;
pci_read_config_dword(pdev, SNR_IMC_MMIO_BASE_OFFSET, &pci_dword);
- addr = (pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23;
+ addr = ((resource_size_t)pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23;
pci_read_config_dword(pdev, mem_offset, &pci_dword);
addr |= (pci_dword & SNR_IMC_MMIO_MEM0_MASK) << 12;
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-08-26 7:45 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-06 11:45 [PATCH][next] perf/x86/intel/uncore: Fix integer overflow on 23 bit left shift of a u32 Colin King
2021-07-06 13:28 ` Liang, Kan
2021-07-27 13:58 ` [tip: perf/core] " tip-bot2 for Colin Ian King
2021-08-26 7:45 ` [tip: perf/urgent] " tip-bot2 for Colin Ian King
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.