All of lore.kernel.org
 help / color / mirror / Atom feed
From: Geert Uytterhoeven <geert+renesas@glider.be>
To: Rob Clark <robdclark@gmail.com>,
	Abhinav Kumar <quic_abhinavk@quicinc.com>,
	Dmitry Baryshkov <dmitry.baryshkov@linaro.org>,
	Sean Paul <sean@poorly.run>, David Airlie <airlied@gmail.com>,
	Daniel Vetter <daniel@ffwll.ch>, Vinod Koul <vkoul@kernel.org>,
	Konrad Dybcio <konrad.dybcio@linaro.org>,
	Bjorn Andersson <andersson@kernel.org>,
	Neil Armstrong <neil.armstrong@linaro.org>,
	Kuogee Hsieh <quic_khsieh@quicinc.com>
Cc: linux-arm-msm@vger.kernel.org, dri-devel@lists.freedesktop.org,
	freedreno@lists.freedesktop.org, linux-kernel@vger.kernel.org,
	Geert Uytterhoeven <geert+renesas@glider.be>
Subject: [PATCH] drm/msm/dpu: Fix bit-shifting UB in DPU_HW_VER() macro
Date: Mon,  6 Mar 2023 10:06:33 +0100	[thread overview]
Message-ID: <20230306090633.65918-1-geert+renesas@glider.be> (raw)

With gcc-5 and CONFIG_UBSAN_SHIFT=y:

    drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable':
    drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant
      case DPU_HW_VER_800:
      ^
    drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant
      case DPU_HW_VER_810:
      ^
    drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant
      case DPU_HW_VER_900:
      ^

This happens because for major revisions 8 or greather, the non-sign bit
of the major revision number is shifted into bit 31 of a signed integer,
which is undefined behavior.

Fix this by casting the major revision number to unsigned int.

Fixes: efcd0107727c4f04 ("drm/msm/dpu: add support for SM8550")
Fixes: 4a352c2fc15aec1e ("drm/msm/dpu: Introduce SC8280XP")
Fixes: 100d7ef6995d1f86 ("drm/msm/dpu: add support for SM8450")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
index ddab9caebb18c40d..bbd3cbdd77956c5d 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
@@ -19,8 +19,9 @@
  */
 #define MAX_BLOCKS    12
 
-#define DPU_HW_VER(MAJOR, MINOR, STEP) (((MAJOR & 0xF) << 28)    |\
-		((MINOR & 0xFFF) << 16)  |\
+#define DPU_HW_VER(MAJOR, MINOR, STEP)			\
+		((((unsigned int)MAJOR & 0xF) << 28) |	\
+		((MINOR & 0xFFF) << 16) |		\
 		(STEP & 0xFFFF))
 
 #define DPU_HW_MAJOR(rev)		((rev) >> 28)
-- 
2.34.1


WARNING: multiple messages have this Message-ID (diff)
From: Geert Uytterhoeven <geert+renesas@glider.be>
To: Rob Clark <robdclark@gmail.com>,
	Abhinav Kumar <quic_abhinavk@quicinc.com>,
	Dmitry Baryshkov <dmitry.baryshkov@linaro.org>,
	Sean Paul <sean@poorly.run>, David Airlie <airlied@gmail.com>,
	Daniel Vetter <daniel@ffwll.ch>, Vinod Koul <vkoul@kernel.org>,
	Konrad Dybcio <konrad.dybcio@linaro.org>,
	Bjorn Andersson <andersson@kernel.org>,
	Neil Armstrong <neil.armstrong@linaro.org>,
	Kuogee Hsieh <quic_khsieh@quicinc.com>
Cc: linux-arm-msm@vger.kernel.org,
	Geert Uytterhoeven <geert+renesas@glider.be>,
	freedreno@lists.freedesktop.org, linux-kernel@vger.kernel.org,
	dri-devel@lists.freedesktop.org
Subject: [PATCH] drm/msm/dpu: Fix bit-shifting UB in DPU_HW_VER() macro
Date: Mon,  6 Mar 2023 10:06:33 +0100	[thread overview]
Message-ID: <20230306090633.65918-1-geert+renesas@glider.be> (raw)

With gcc-5 and CONFIG_UBSAN_SHIFT=y:

    drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable':
    drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant
      case DPU_HW_VER_800:
      ^
    drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant
      case DPU_HW_VER_810:
      ^
    drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant
      case DPU_HW_VER_900:
      ^

This happens because for major revisions 8 or greather, the non-sign bit
of the major revision number is shifted into bit 31 of a signed integer,
which is undefined behavior.

Fix this by casting the major revision number to unsigned int.

Fixes: efcd0107727c4f04 ("drm/msm/dpu: add support for SM8550")
Fixes: 4a352c2fc15aec1e ("drm/msm/dpu: Introduce SC8280XP")
Fixes: 100d7ef6995d1f86 ("drm/msm/dpu: add support for SM8450")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
index ddab9caebb18c40d..bbd3cbdd77956c5d 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
@@ -19,8 +19,9 @@
  */
 #define MAX_BLOCKS    12
 
-#define DPU_HW_VER(MAJOR, MINOR, STEP) (((MAJOR & 0xF) << 28)    |\
-		((MINOR & 0xFFF) << 16)  |\
+#define DPU_HW_VER(MAJOR, MINOR, STEP)			\
+		((((unsigned int)MAJOR & 0xF) << 28) |	\
+		((MINOR & 0xFFF) << 16) |		\
 		(STEP & 0xFFFF))
 
 #define DPU_HW_MAJOR(rev)		((rev) >> 28)
-- 
2.34.1


             reply	other threads:[~2023-03-06  9:06 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-03-06  9:06 Geert Uytterhoeven [this message]
2023-03-06  9:06 ` [PATCH] drm/msm/dpu: Fix bit-shifting UB in DPU_HW_VER() macro Geert Uytterhoeven
2023-03-21 15:08 ` Randy Dunlap
2023-03-21 15:08   ` Randy Dunlap
2023-03-22 20:48   ` Rob Clark
2023-03-22 20:48     ` Rob Clark
2023-03-28 22:37 ` Dmitry Baryshkov
2023-03-28 22:37   ` Dmitry Baryshkov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230306090633.65918-1-geert+renesas@glider.be \
    --to=geert+renesas@glider.be \
    --cc=airlied@gmail.com \
    --cc=andersson@kernel.org \
    --cc=daniel@ffwll.ch \
    --cc=dmitry.baryshkov@linaro.org \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=freedreno@lists.freedesktop.org \
    --cc=konrad.dybcio@linaro.org \
    --cc=linux-arm-msm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=neil.armstrong@linaro.org \
    --cc=quic_abhinavk@quicinc.com \
    --cc=quic_khsieh@quicinc.com \
    --cc=robdclark@gmail.com \
    --cc=sean@poorly.run \
    --cc=vkoul@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.