From: Laurent Pinchart <laurent.pinchart@ideasonboard.com> To: Geert Uytterhoeven <geert+renesas@glider.be> Cc: Andrzej Hajda <a.hajda@samsung.com>, Neil Armstrong <narmstrong@baylibre.com>, Jonas Karlman <jonas@kwiboo.se>, Jernej Skrabec <jernej.skrabec@siol.net>, David Airlie <airlied@linux.ie>, Daniel Vetter <daniel@ffwll.ch>, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit Date: Tue, 12 Jan 2021 06:37:45 +0200 [thread overview] Message-ID: <X/0nmQ/XBpj6PJAh@pendragon.ideasonboard.com> (raw) In-Reply-To: <20210111125702.360745-1-geert+renesas@glider.be> Hi Geert, Thank you for the patch. On Mon, Jan 11, 2021 at 01:57:02PM +0100, Geert Uytterhoeven wrote: > As nwl_dsi.lanes is u32, and NSEC_PER_SEC is 1000000000L, the second > multiplication in > > dsi->lanes * 8 * NSEC_PER_SEC > > will overflow on a 32-bit platform. Fix this by making the constant > unsigned long long, forcing 64-bit arithmetic. > > While iMX8 is arm64, this driver is currently used on 64-bit platforms > only, where long is 64-bit, so this cannot happen. But the issue may > start to happen when the driver is reused for a 32-bit SoC, or when code > is copied for a new driver. > > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> > --- > Compile-tested only. > --- > drivers/gpu/drm/bridge/nwl-dsi.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c > index 66b67402f1acd57d..a8da3081efdcc84e 100644 > --- a/drivers/gpu/drm/bridge/nwl-dsi.c > +++ b/drivers/gpu/drm/bridge/nwl-dsi.c > @@ -195,7 +195,7 @@ static u32 ps2bc(struct nwl_dsi *dsi, unsigned long long ps) > u32 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format); > > return DIV64_U64_ROUND_UP(ps * dsi->mode.clock * bpp, > - dsi->lanes * 8 * NSEC_PER_SEC); > + dsi->lanes * 8ULL * NSEC_PER_SEC); I wonder if we could get rid of a whole class of bugs by turning NSEC_PER_SEC into a ULL, but I suppose there are valid cases where a 32-bit integer is enough. Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> How did you come across this by the way ? > } > > /* -- Regards, Laurent Pinchart
WARNING: multiple messages have this Message-ID (diff)
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com> To: Geert Uytterhoeven <geert+renesas@glider.be> Cc: Jernej Skrabec <jernej.skrabec@siol.net>, Jonas Karlman <jonas@kwiboo.se>, David Airlie <airlied@linux.ie>, Neil Armstrong <narmstrong@baylibre.com>, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, Andrzej Hajda <a.hajda@samsung.com> Subject: Re: [PATCH] drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit Date: Tue, 12 Jan 2021 06:37:45 +0200 [thread overview] Message-ID: <X/0nmQ/XBpj6PJAh@pendragon.ideasonboard.com> (raw) In-Reply-To: <20210111125702.360745-1-geert+renesas@glider.be> Hi Geert, Thank you for the patch. On Mon, Jan 11, 2021 at 01:57:02PM +0100, Geert Uytterhoeven wrote: > As nwl_dsi.lanes is u32, and NSEC_PER_SEC is 1000000000L, the second > multiplication in > > dsi->lanes * 8 * NSEC_PER_SEC > > will overflow on a 32-bit platform. Fix this by making the constant > unsigned long long, forcing 64-bit arithmetic. > > While iMX8 is arm64, this driver is currently used on 64-bit platforms > only, where long is 64-bit, so this cannot happen. But the issue may > start to happen when the driver is reused for a 32-bit SoC, or when code > is copied for a new driver. > > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> > --- > Compile-tested only. > --- > drivers/gpu/drm/bridge/nwl-dsi.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c > index 66b67402f1acd57d..a8da3081efdcc84e 100644 > --- a/drivers/gpu/drm/bridge/nwl-dsi.c > +++ b/drivers/gpu/drm/bridge/nwl-dsi.c > @@ -195,7 +195,7 @@ static u32 ps2bc(struct nwl_dsi *dsi, unsigned long long ps) > u32 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format); > > return DIV64_U64_ROUND_UP(ps * dsi->mode.clock * bpp, > - dsi->lanes * 8 * NSEC_PER_SEC); > + dsi->lanes * 8ULL * NSEC_PER_SEC); I wonder if we could get rid of a whole class of bugs by turning NSEC_PER_SEC into a ULL, but I suppose there are valid cases where a 32-bit integer is enough. Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> How did you come across this by the way ? > } > > /* -- Regards, Laurent Pinchart _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2021-01-12 4:38 UTC|newest] Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-01-11 12:57 [PATCH] drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit Geert Uytterhoeven 2021-01-11 12:57 ` Geert Uytterhoeven 2021-01-11 18:07 ` Fabio Estevam 2021-01-11 18:07 ` Fabio Estevam 2021-01-12 4:37 ` Laurent Pinchart [this message] 2021-01-12 4:37 ` Laurent Pinchart 2021-01-12 8:46 ` Geert Uytterhoeven 2021-01-12 8:46 ` Geert Uytterhoeven
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=X/0nmQ/XBpj6PJAh@pendragon.ideasonboard.com \ --to=laurent.pinchart@ideasonboard.com \ --cc=a.hajda@samsung.com \ --cc=airlied@linux.ie \ --cc=daniel@ffwll.ch \ --cc=dri-devel@lists.freedesktop.org \ --cc=geert+renesas@glider.be \ --cc=jernej.skrabec@siol.net \ --cc=jonas@kwiboo.se \ --cc=linux-kernel@vger.kernel.org \ --cc=narmstrong@baylibre.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.