kernel-janitors.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] drm/arm: fix unintentional integer overflow on left shift
@ 2020-06-18 10:04 Colin King
  2020-06-18 12:14 ` Liviu Dudau
  0 siblings, 1 reply; 7+ messages in thread
From: Colin King @ 2020-06-18 10:04 UTC (permalink / raw)
  To: Liviu Dudau, Brian Starkey, David Airlie, Daniel Vetter, dri-devel
  Cc: kernel-janitors, linux-kernel

From: Colin Ian King <colin.king@canonical.com>

Shifting the integer value 1 is evaluated using 32-bit arithmetic
and then used in an expression that expects a long value leads to
a potential integer overflow. Fix this by using the BIT macro to
perform the shift to avoid the overflow.

Addresses-Coverity: ("Unintentional integer overflow")
Fixes: ad49f8602fe8 ("drm/arm: Add support for Mali Display Processors")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/gpu/drm/arm/malidp_planes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
index 37715cc6064e..ab45ac445045 100644
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm)
 	const struct malidp_hw_regmap *map = &malidp->dev->hw->map;
 	struct malidp_plane *plane = NULL;
 	enum drm_plane_type plane_type;
-	unsigned long crtcs = 1 << drm->mode_config.num_crtc;
+	unsigned long crtcs = BIT(drm->mode_config.num_crtc);
 	unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 |
 			      DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y;
 	unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) |
-- 
2.27.0.rc0

^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH] drm/arm: fix unintentional integer overflow on left shift
  2020-06-18 10:04 [PATCH] drm/arm: fix unintentional integer overflow on left shift Colin King
@ 2020-06-18 12:14 ` Liviu Dudau
  2020-06-18 12:50   ` Colin Ian King
  0 siblings, 1 reply; 7+ messages in thread
From: Liviu Dudau @ 2020-06-18 12:14 UTC (permalink / raw)
  To: Colin King; +Cc: David Airlie, kernel-janitors, linux-kernel, dri-devel

On Thu, Jun 18, 2020 at 11:04:00AM +0100, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>

Hi Colin,

> 
> Shifting the integer value 1 is evaluated using 32-bit arithmetic
> and then used in an expression that expects a long value leads to
> a potential integer overflow.

I'm afraid this explanation makes no sense to me. Do you care to explain better what
you think the issue is? If the shift is done as 32-bit arithmetic and then promoted
to long how does the overflow happen?

Best regards,
Liviu

> Fix this by using the BIT macro to
> perform the shift to avoid the overflow.
> 
> Addresses-Coverity: ("Unintentional integer overflow")
> Fixes: ad49f8602fe8 ("drm/arm: Add support for Mali Display Processors")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
>  drivers/gpu/drm/arm/malidp_planes.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
> index 37715cc6064e..ab45ac445045 100644
> --- a/drivers/gpu/drm/arm/malidp_planes.c
> +++ b/drivers/gpu/drm/arm/malidp_planes.c
> @@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm)
>  	const struct malidp_hw_regmap *map = &malidp->dev->hw->map;
>  	struct malidp_plane *plane = NULL;
>  	enum drm_plane_type plane_type;
> -	unsigned long crtcs = 1 << drm->mode_config.num_crtc;
> +	unsigned long crtcs = BIT(drm->mode_config.num_crtc);
>  	unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 |
>  			      DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y;
>  	unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) |
> -- 
> 2.27.0.rc0
> 

-- 
==========
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] drm/arm: fix unintentional integer overflow on left shift
  2020-06-18 12:14 ` Liviu Dudau
@ 2020-06-18 12:50   ` Colin Ian King
  2020-06-18 14:21     ` Liviu Dudau
  0 siblings, 1 reply; 7+ messages in thread
From: Colin Ian King @ 2020-06-18 12:50 UTC (permalink / raw)
  To: Liviu Dudau; +Cc: David Airlie, kernel-janitors, linux-kernel, dri-devel

On 18/06/2020 13:14, Liviu Dudau wrote:
> On Thu, Jun 18, 2020 at 11:04:00AM +0100, Colin King wrote:
>> From: Colin Ian King <colin.king@canonical.com>
> 
> Hi Colin,
> 
>>
>> Shifting the integer value 1 is evaluated using 32-bit arithmetic
>> and then used in an expression that expects a long value leads to
>> a potential integer overflow.
> 
> I'm afraid this explanation makes no sense to me. Do you care to explain better what
> you think the issue is? If the shift is done as 32-bit arithmetic and then promoted
> to long how does the overflow happen?

The shift is performed using 32 bit signed math and then assigned to an
unsigned 64 bit long. This if the shift is 31 bits then the signed int
conversion of 0x80000000 to unsigned long becomes 0xffffffff80000000.
If the shift is more than 32 bits then result overflows and becomes 0x0.

Colin

> 
> Best regards,
> Liviu
> 
>> Fix this by using the BIT macro to
>> perform the shift to avoid the overflow.
>>
>> Addresses-Coverity: ("Unintentional integer overflow")
>> Fixes: ad49f8602fe8 ("drm/arm: Add support for Mali Display Processors")
>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>> ---
>>  drivers/gpu/drm/arm/malidp_planes.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
>> index 37715cc6064e..ab45ac445045 100644
>> --- a/drivers/gpu/drm/arm/malidp_planes.c
>> +++ b/drivers/gpu/drm/arm/malidp_planes.c
>> @@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm)
>>  	const struct malidp_hw_regmap *map = &malidp->dev->hw->map;
>>  	struct malidp_plane *plane = NULL;
>>  	enum drm_plane_type plane_type;
>> -	unsigned long crtcs = 1 << drm->mode_config.num_crtc;
>> +	unsigned long crtcs = BIT(drm->mode_config.num_crtc);
>>  	unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 |
>>  			      DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y;
>>  	unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) |
>> -- 
>> 2.27.0.rc0
>>
> 

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] drm/arm: fix unintentional integer overflow on left shift
  2020-06-18 12:50   ` Colin Ian King
@ 2020-06-18 14:21     ` Liviu Dudau
  2020-06-18 14:36       ` Garrit Franke
  0 siblings, 1 reply; 7+ messages in thread
From: Liviu Dudau @ 2020-06-18 14:21 UTC (permalink / raw)
  To: Colin Ian King; +Cc: David Airlie, kernel-janitors, linux-kernel, dri-devel

On Thu, Jun 18, 2020 at 01:50:34PM +0100, Colin Ian King wrote:
> On 18/06/2020 13:14, Liviu Dudau wrote:
> > On Thu, Jun 18, 2020 at 11:04:00AM +0100, Colin King wrote:
> >> From: Colin Ian King <colin.king@canonical.com>
> > 
> > Hi Colin,
> > 
> >>
> >> Shifting the integer value 1 is evaluated using 32-bit arithmetic
> >> and then used in an expression that expects a long value leads to
> >> a potential integer overflow.
> > 
> > I'm afraid this explanation makes no sense to me. Do you care to explain better what
> > you think the issue is? If the shift is done as 32-bit arithmetic and then promoted
> > to long how does the overflow happen?
> 
> The shift is performed using 32 bit signed math and then assigned to an
> unsigned 64 bit long. This if the shift is 31 bits then the signed int
> conversion of 0x80000000 to unsigned long becomes 0xffffffff80000000.
> If the shift is more than 32 bits then result overflows and becomes 0x0.

You are right, I've missed the fact that it is signed math. Not very likely that
we are going to ever have 30 or more CRTCs in the driver, but Coverity has no
way of knowing that.

Acked-by: Liviu Dudau <liviu.dudau@arm.com>

I will pull this into drm-misc-next today.

Best regards,
Liviu

> 
> Colin
> 
> > 
> > Best regards,
> > Liviu
> > 
> >> Fix this by using the BIT macro to
> >> perform the shift to avoid the overflow.
> >>
> >> Addresses-Coverity: ("Unintentional integer overflow")
> >> Fixes: ad49f8602fe8 ("drm/arm: Add support for Mali Display Processors")
> >> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> >> ---
> >>  drivers/gpu/drm/arm/malidp_planes.c | 2 +-
> >>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
> >> index 37715cc6064e..ab45ac445045 100644
> >> --- a/drivers/gpu/drm/arm/malidp_planes.c
> >> +++ b/drivers/gpu/drm/arm/malidp_planes.c
> >> @@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm)
> >>  	const struct malidp_hw_regmap *map = &malidp->dev->hw->map;
> >>  	struct malidp_plane *plane = NULL;
> >>  	enum drm_plane_type plane_type;
> >> -	unsigned long crtcs = 1 << drm->mode_config.num_crtc;
> >> +	unsigned long crtcs = BIT(drm->mode_config.num_crtc);
> >>  	unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 |
> >>  			      DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y;
> >>  	unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) |
> >> -- 
> >> 2.27.0.rc0
> >>
> > 
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
==========
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] drm/arm: fix unintentional integer overflow on left shift
  2020-06-18 14:21     ` Liviu Dudau
@ 2020-06-18 14:36       ` Garrit Franke
  2020-06-18 14:38         ` Colin Ian King
  2020-06-18 15:22         ` Dan Carpenter
  0 siblings, 2 replies; 7+ messages in thread
From: Garrit Franke @ 2020-06-18 14:36 UTC (permalink / raw)
  To: Liviu Dudau
  Cc: David Airlie, Colin Ian King, kernel-janitors, linux-kernel, dri-devel

Hi all, newbie here.
Can the BIT macro be safely used on other parts of the kernel as well?
Just using git grep "1 <<" returns a ton of results where bit shifting
is used the old fashioned way.

Am Do., 18. Juni 2020 um 16:23 Uhr schrieb Liviu Dudau <liviu.dudau@arm.com>:
>
> On Thu, Jun 18, 2020 at 01:50:34PM +0100, Colin Ian King wrote:
> > On 18/06/2020 13:14, Liviu Dudau wrote:
> > > On Thu, Jun 18, 2020 at 11:04:00AM +0100, Colin King wrote:
> > >> From: Colin Ian King <colin.king@canonical.com>
> > >
> > > Hi Colin,
> > >
> > >>
> > >> Shifting the integer value 1 is evaluated using 32-bit arithmetic
> > >> and then used in an expression that expects a long value leads to
> > >> a potential integer overflow.
> > >
> > > I'm afraid this explanation makes no sense to me. Do you care to explain better what
> > > you think the issue is? If the shift is done as 32-bit arithmetic and then promoted
> > > to long how does the overflow happen?
> >
> > The shift is performed using 32 bit signed math and then assigned to an
> > unsigned 64 bit long. This if the shift is 31 bits then the signed int
> > conversion of 0x80000000 to unsigned long becomes 0xffffffff80000000.
> > If the shift is more than 32 bits then result overflows and becomes 0x0.
>
> You are right, I've missed the fact that it is signed math. Not very likely that
> we are going to ever have 30 or more CRTCs in the driver, but Coverity has no
> way of knowing that.
>
> Acked-by: Liviu Dudau <liviu.dudau@arm.com>
>
> I will pull this into drm-misc-next today.
>
> Best regards,
> Liviu
>
> >
> > Colin
> >
> > >
> > > Best regards,
> > > Liviu
> > >
> > >> Fix this by using the BIT macro to
> > >> perform the shift to avoid the overflow.
> > >>
> > >> Addresses-Coverity: ("Unintentional integer overflow")
> > >> Fixes: ad49f8602fe8 ("drm/arm: Add support for Mali Display Processors")
> > >> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> > >> ---
> > >>  drivers/gpu/drm/arm/malidp_planes.c | 2 +-
> > >>  1 file changed, 1 insertion(+), 1 deletion(-)
> > >>
> > >> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
> > >> index 37715cc6064e..ab45ac445045 100644
> > >> --- a/drivers/gpu/drm/arm/malidp_planes.c
> > >> +++ b/drivers/gpu/drm/arm/malidp_planes.c
> > >> @@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm)
> > >>    const struct malidp_hw_regmap *map = &malidp->dev->hw->map;
> > >>    struct malidp_plane *plane = NULL;
> > >>    enum drm_plane_type plane_type;
> > >> -  unsigned long crtcs = 1 << drm->mode_config.num_crtc;
> > >> +  unsigned long crtcs = BIT(drm->mode_config.num_crtc);
> > >>    unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 |
> > >>                          DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y;
> > >>    unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) |
> > >> --
> > >> 2.27.0.rc0
> > >>
> > >
> >
> > _______________________________________________
> > dri-devel mailing list
> > dri-devel@lists.freedesktop.org
> > https://lists.freedesktop.org/mailman/listinfo/dri-devel
>
> --
> ====================
> | I would like to |
> | fix the world,  |
> | but they're not |
> | giving me the   |
>  \ source code!  /
>   ---------------
>     ¯\_(ツ)_/¯

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] drm/arm: fix unintentional integer overflow on left shift
  2020-06-18 14:36       ` Garrit Franke
@ 2020-06-18 14:38         ` Colin Ian King
  2020-06-18 15:22         ` Dan Carpenter
  1 sibling, 0 replies; 7+ messages in thread
From: Colin Ian King @ 2020-06-18 14:38 UTC (permalink / raw)
  To: Garrit Franke, Liviu Dudau
  Cc: David Airlie, kernel-janitors, linux-kernel, dri-devel

On 18/06/2020 15:36, Garrit Franke wrote:
> Hi all, newbie here.
> Can the BIT macro be safely used on other parts of the kernel as well?
> Just using git grep "1 <<" returns a ton of results where bit shifting
> is used the old fashioned way.

The BIT macro casts the 1 it a UL before shifting so it catches these
type of bugs.  use BIT_ULL when the result is assigned to a long long.

Colin

> 
> Am Do., 18. Juni 2020 um 16:23 Uhr schrieb Liviu Dudau <liviu.dudau@arm.com>:
>>
>> On Thu, Jun 18, 2020 at 01:50:34PM +0100, Colin Ian King wrote:
>>> On 18/06/2020 13:14, Liviu Dudau wrote:
>>>> On Thu, Jun 18, 2020 at 11:04:00AM +0100, Colin King wrote:
>>>>> From: Colin Ian King <colin.king@canonical.com>
>>>>
>>>> Hi Colin,
>>>>
>>>>>
>>>>> Shifting the integer value 1 is evaluated using 32-bit arithmetic
>>>>> and then used in an expression that expects a long value leads to
>>>>> a potential integer overflow.
>>>>
>>>> I'm afraid this explanation makes no sense to me. Do you care to explain better what
>>>> you think the issue is? If the shift is done as 32-bit arithmetic and then promoted
>>>> to long how does the overflow happen?
>>>
>>> The shift is performed using 32 bit signed math and then assigned to an
>>> unsigned 64 bit long. This if the shift is 31 bits then the signed int
>>> conversion of 0x80000000 to unsigned long becomes 0xffffffff80000000.
>>> If the shift is more than 32 bits then result overflows and becomes 0x0.
>>
>> You are right, I've missed the fact that it is signed math. Not very likely that
>> we are going to ever have 30 or more CRTCs in the driver, but Coverity has no
>> way of knowing that.
>>
>> Acked-by: Liviu Dudau <liviu.dudau@arm.com>
>>
>> I will pull this into drm-misc-next today.
>>
>> Best regards,
>> Liviu
>>
>>>
>>> Colin
>>>
>>>>
>>>> Best regards,
>>>> Liviu
>>>>
>>>>> Fix this by using the BIT macro to
>>>>> perform the shift to avoid the overflow.
>>>>>
>>>>> Addresses-Coverity: ("Unintentional integer overflow")
>>>>> Fixes: ad49f8602fe8 ("drm/arm: Add support for Mali Display Processors")
>>>>> Signed-off-by: Colin Ian King <colin.king@canonical.com>
>>>>> ---
>>>>>  drivers/gpu/drm/arm/malidp_planes.c | 2 +-
>>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
>>>>> index 37715cc6064e..ab45ac445045 100644
>>>>> --- a/drivers/gpu/drm/arm/malidp_planes.c
>>>>> +++ b/drivers/gpu/drm/arm/malidp_planes.c
>>>>> @@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm)
>>>>>    const struct malidp_hw_regmap *map = &malidp->dev->hw->map;
>>>>>    struct malidp_plane *plane = NULL;
>>>>>    enum drm_plane_type plane_type;
>>>>> -  unsigned long crtcs = 1 << drm->mode_config.num_crtc;
>>>>> +  unsigned long crtcs = BIT(drm->mode_config.num_crtc);
>>>>>    unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 |
>>>>>                          DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y;
>>>>>    unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) |
>>>>> --
>>>>> 2.27.0.rc0
>>>>>
>>>>
>>>
>>> _______________________________________________
>>> dri-devel mailing list
>>> dri-devel@lists.freedesktop.org
>>> https://lists.freedesktop.org/mailman/listinfo/dri-devel
>>
>> --
>> ==========
>> | I would like to |
>> | fix the world,  |
>> | but they're not |
>> | giving me the   |
>>  \ source code!  /
>>   ---------------
>>     ¯\_(ツ)_/¯

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] drm/arm: fix unintentional integer overflow on left shift
  2020-06-18 14:36       ` Garrit Franke
  2020-06-18 14:38         ` Colin Ian King
@ 2020-06-18 15:22         ` Dan Carpenter
  1 sibling, 0 replies; 7+ messages in thread
From: Dan Carpenter @ 2020-06-18 15:22 UTC (permalink / raw)
  To: Garrit Franke
  Cc: David Airlie, Liviu Dudau, kernel-janitors, linux-kernel,
	dri-devel, Colin Ian King

On Thu, Jun 18, 2020 at 04:36:51PM +0200, Garrit Franke wrote:
> Hi all, newbie here.
> Can the BIT macro be safely used on other parts of the kernel as well?
> Just using git grep "1 <<" returns a ton of results where bit shifting
> is used the old fashioned way.

Yeah.  There is a checkpatch warning for it and everything.  :)

But I like the way you think.  Start with patches to staging though.
People don't necessarily like doing cleanups on ancient code.

regards,
dan carpenter

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2020-06-18 15:22 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-18 10:04 [PATCH] drm/arm: fix unintentional integer overflow on left shift Colin King
2020-06-18 12:14 ` Liviu Dudau
2020-06-18 12:50   ` Colin Ian King
2020-06-18 14:21     ` Liviu Dudau
2020-06-18 14:36       ` Garrit Franke
2020-06-18 14:38         ` Colin Ian King
2020-06-18 15:22         ` Dan Carpenter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).