dri-devel Archive on lore.kernel.org
 help / color / Atom feed
* [Bug Report] drivers/video/fbdev/da8xx-fb.c: undefined behavior when left shifting
@ 2020-05-22  3:01 Changming Liu
  0 siblings, 0 replies; only message in thread
From: Changming Liu @ 2020-05-22  3:01 UTC (permalink / raw)
  To: b.zolnierkie; +Cc: linux-fbdev, Lu, Long, dri-devel, yaohway

Hi Bartlomiej,
Greetings, it's me again, I sent you a bug report yesterday, I hope that find you well.

This time I found that in /drivers/video/fbdev/da8xx-fb.c
function lcd_cfg_vertical_sync, there might be an undefined result by left shifting.

More specifically, in function lcd_cfg_vertical_sync, line 437. back_porch is a signed integer 
which might come from user space. And it's logic AND with string literal 0xff. The result is then left shifted by 24 bits.

The problem is, since the logic AND produce a signed integer and the result of left shifting this signed integer
(whose lowest 8 bits not cleared) by 24 bits is undefined when its 8th bit is 1. Similar patterns can be found in line 410 as well.

I wonder if this bug is worth fixing? This can help me understand linux and UB a lot.

Looking forward to you valuable response.

Best regards,
Changming Liu
dri-devel mailing list

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-22  3:01 [Bug Report] drivers/video/fbdev/da8xx-fb.c: undefined behavior when left shifting Changming Liu

dri-devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/dri-devel/0 dri-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 dri-devel dri-devel/ https://lore.kernel.org/dri-devel \
	public-inbox-index dri-devel

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone https://public-inbox.org/public-inbox.git