From: Vinod Koul <vkoul@kernel.org> To: Harini Katakam <harini.katakam@xilinx.com> Cc: romain.perier@gmail.com, allen.lkml@gmail.com, yukuai3@huawei.com, dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, harinikatakamlinux@gmail.com, michal.simek@xilinx.com, radhey.shyam.pandey@xilinx.com, shravya.kumbham@xilinx.com Subject: Re: [PATCH 1/4] dmaengine: zynqmp_dma: Typecast the variable to handle overflow Date: Mon, 25 Oct 2021 11:40:33 +0530 [thread overview] Message-ID: <YXZKWVsDU+067GCz@matsya> (raw) In-Reply-To: <20210914082817.22311-2-harini.katakam@xilinx.com> On 14-09-21, 13:58, Harini Katakam wrote: > From: Shravya Kumbham <shravya.kumbham@xilinx.com> > > In zynqmp_dma_alloc/free_chan_resources functions there is a > potential overflow in the below expressions. > > dma_alloc_coherent(chan->dev, (2 * chan->desc_size * > ZYNQMP_DMA_NUM_DESCS), > &chan->desc_pool_p, GFP_KERNEL); > > dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * > ZYNQMP_DMA_NUM_DESCS), > chan->desc_pool_v, chan->desc_pool_p); > > The arguments desc_size and ZYNQMP_DMA_NUM_DESCS are 32 bit. Though > this overflow condition is not observed but it is a potential problem > in the case of 32-bit multiplication. Hence fix it by using typecast. > > Addresses-Coverity: Event overflow_before_widen. > Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com> Patch was sent by Harini Katakam <harini.katakam@xilinx.com> and SOB not available for person sending this patch, sorry cant accept it with s-o-b... > Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com> > --- > drivers/dma/xilinx/zynqmp_dma.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c > index 5fecf5aa6e85..2d0eba25739d 100644 > --- a/drivers/dma/xilinx/zynqmp_dma.c > +++ b/drivers/dma/xilinx/zynqmp_dma.c > @@ -490,7 +490,8 @@ static int zynqmp_dma_alloc_chan_resources(struct dma_chan *dchan) > } > > chan->desc_pool_v = dma_alloc_coherent(chan->dev, > - (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), > + ((size_t)(2 * chan->desc_size) * > + ZYNQMP_DMA_NUM_DESCS), > &chan->desc_pool_p, GFP_KERNEL); > if (!chan->desc_pool_v) > return -ENOMEM; > @@ -677,7 +678,8 @@ static void zynqmp_dma_free_chan_resources(struct dma_chan *dchan) > zynqmp_dma_free_descriptors(chan); > spin_unlock_irqrestore(&chan->lock, irqflags); > dma_free_coherent(chan->dev, > - (2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), > + ((size_t)(2 * ZYNQMP_DMA_DESC_SIZE(chan)) * > + ZYNQMP_DMA_NUM_DESCS), > chan->desc_pool_v, chan->desc_pool_p); > kfree(chan->sw_desc_pool); > pm_runtime_mark_last_busy(chan->dev); > -- > 2.17.1 -- ~Vinod
WARNING: multiple messages have this Message-ID (diff)
From: Vinod Koul <vkoul@kernel.org> To: Harini Katakam <harini.katakam@xilinx.com> Cc: romain.perier@gmail.com, allen.lkml@gmail.com, yukuai3@huawei.com, dmaengine@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, harinikatakamlinux@gmail.com, michal.simek@xilinx.com, radhey.shyam.pandey@xilinx.com, shravya.kumbham@xilinx.com Subject: Re: [PATCH 1/4] dmaengine: zynqmp_dma: Typecast the variable to handle overflow Date: Mon, 25 Oct 2021 11:40:33 +0530 [thread overview] Message-ID: <YXZKWVsDU+067GCz@matsya> (raw) In-Reply-To: <20210914082817.22311-2-harini.katakam@xilinx.com> On 14-09-21, 13:58, Harini Katakam wrote: > From: Shravya Kumbham <shravya.kumbham@xilinx.com> > > In zynqmp_dma_alloc/free_chan_resources functions there is a > potential overflow in the below expressions. > > dma_alloc_coherent(chan->dev, (2 * chan->desc_size * > ZYNQMP_DMA_NUM_DESCS), > &chan->desc_pool_p, GFP_KERNEL); > > dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * > ZYNQMP_DMA_NUM_DESCS), > chan->desc_pool_v, chan->desc_pool_p); > > The arguments desc_size and ZYNQMP_DMA_NUM_DESCS are 32 bit. Though > this overflow condition is not observed but it is a potential problem > in the case of 32-bit multiplication. Hence fix it by using typecast. > > Addresses-Coverity: Event overflow_before_widen. > Signed-off-by: Shravya Kumbham <shravya.kumbham@xilinx.com> Patch was sent by Harini Katakam <harini.katakam@xilinx.com> and SOB not available for person sending this patch, sorry cant accept it with s-o-b... > Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com> > --- > drivers/dma/xilinx/zynqmp_dma.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c > index 5fecf5aa6e85..2d0eba25739d 100644 > --- a/drivers/dma/xilinx/zynqmp_dma.c > +++ b/drivers/dma/xilinx/zynqmp_dma.c > @@ -490,7 +490,8 @@ static int zynqmp_dma_alloc_chan_resources(struct dma_chan *dchan) > } > > chan->desc_pool_v = dma_alloc_coherent(chan->dev, > - (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), > + ((size_t)(2 * chan->desc_size) * > + ZYNQMP_DMA_NUM_DESCS), > &chan->desc_pool_p, GFP_KERNEL); > if (!chan->desc_pool_v) > return -ENOMEM; > @@ -677,7 +678,8 @@ static void zynqmp_dma_free_chan_resources(struct dma_chan *dchan) > zynqmp_dma_free_descriptors(chan); > spin_unlock_irqrestore(&chan->lock, irqflags); > dma_free_coherent(chan->dev, > - (2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), > + ((size_t)(2 * ZYNQMP_DMA_DESC_SIZE(chan)) * > + ZYNQMP_DMA_NUM_DESCS), > chan->desc_pool_v, chan->desc_pool_p); > kfree(chan->sw_desc_pool); > pm_runtime_mark_last_busy(chan->dev); > -- > 2.17.1 -- ~Vinod _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2021-10-25 6:10 UTC|newest] Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-09-14 8:28 [PATCH 0/4] ZynqMP DMA fixes Harini Katakam 2021-09-14 8:28 ` Harini Katakam 2021-09-14 8:28 ` [PATCH 1/4] dmaengine: zynqmp_dma: Typecast the variable to handle overflow Harini Katakam 2021-09-14 8:28 ` Harini Katakam 2021-09-23 14:11 ` Michael Tretter 2021-09-23 14:11 ` Michael Tretter 2021-10-25 6:10 ` Vinod Koul [this message] 2021-10-25 6:10 ` Vinod Koul 2021-09-14 8:28 ` [PATCH 2/4] dmaengine: zynqmp_dma: Typecast the variable with dma_addr_t " Harini Katakam 2021-09-14 8:28 ` Harini Katakam 2021-09-14 8:28 ` [PATCH 3/4] dmaengine: zynqmp_dma: Add conditions for return value check Harini Katakam 2021-09-14 8:28 ` Harini Katakam 2021-09-23 14:40 ` Michael Tretter 2021-09-23 14:40 ` Michael Tretter 2021-10-25 6:12 ` Vinod Koul 2021-10-25 6:12 ` Vinod Koul 2021-09-14 8:28 ` [PATCH 4/4] dmaengine: zynqmp_dma: Typecast with enum to fix the coverity warning Harini Katakam 2021-09-14 8:28 ` Harini Katakam 2021-09-23 14:17 ` Michael Tretter 2021-09-23 14:17 ` Michael Tretter
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=YXZKWVsDU+067GCz@matsya \ --to=vkoul@kernel.org \ --cc=allen.lkml@gmail.com \ --cc=dmaengine@vger.kernel.org \ --cc=harini.katakam@xilinx.com \ --cc=harinikatakamlinux@gmail.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=michal.simek@xilinx.com \ --cc=radhey.shyam.pandey@xilinx.com \ --cc=romain.perier@gmail.com \ --cc=shravya.kumbham@xilinx.com \ --cc=yukuai3@huawei.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.