* drm_modes: signed integer overflow @ 2020-10-22 3:13 Randy Dunlap 2020-10-22 10:14 ` [Intel-gfx] " Ville Syrjälä 0 siblings, 1 reply; 5+ messages in thread From: Randy Dunlap @ 2020-10-22 3:13 UTC (permalink / raw) To: dri-devel, LKML, David Airlie, Daniel Vetter, intel-gfx Hi, With linux-next 20201021, when booting up, I am seeing this: [ 0.560896] UBSAN: signed-integer-overflow in ../drivers/gpu/drm/drm_modes.c:765:20 [ 0.560903] 2376000 * 1000 cannot be represented in type 'int' [ 0.560909] CPU: 3 PID: 7 Comm: kworker/u16:0 Not tainted 5.9.0-next-20201021 #2 [ 0.560914] Hardware name: TOSHIBA PORTEGE R835/Portable PC, BIOS Version 4.10 01/08/2013 [ 0.560924] Workqueue: events_unbound async_run_entry_fn [ 0.560930] Call Trace: [ 0.560938] dump_stack+0x5e/0x74 [ 0.560943] ubsan_epilogue+0x9/0x45 [ 0.560948] handle_overflow+0x8b/0x98 [ 0.560953] ? set_track+0x3f/0xad [ 0.560958] __ubsan_handle_mul_overflow+0xe/0x10 [ 0.560964] drm_mode_vrefresh+0x4a/0xbc [ 0.560970] initcall i915_init+0x0/0x6a returned 0 after 116076 usecs [ 0.560974] calling cn_proc_init+0x0/0x36 @ 1 [ 0.560978] cea_mode_alternate_clock+0x11/0x62 [ 0.560985] drm_match_cea_mode+0xc7/0x1e7 [ 0.560987] initcall cn_proc_init+0x0/0x36 returned 0 after 3 usecs [ 0.560990] calling topology_sysfs_init+0x0/0x2d @ 1 [ 0.561000] drm_mode_validate_ycbcr420+0xd/0x48 [ 0.561005] drm_helper_probe_single_connector_modes+0x6db/0x7da [ 0.561012] drm_client_modeset_probe+0x225/0x143f [ 0.561018] ? bitmap_fold+0x8a/0x8a [ 0.561023] ? update_cfs_rq_load_avg+0x192/0x1a2 [ 0.561029] __drm_fb_helper_initial_config_and_unlock+0x3f/0x5b7 [ 0.561035] ? get_sd_balance_interval+0x1c/0x40 [ 0.561040] drm_fb_helper_initial_config+0x48/0x4f [ 0.561047] intel_fbdev_initial_config+0x13/0x23 [ 0.561052] async_run_entry_fn+0x89/0x15c [ 0.561058] process_one_work+0x15c/0x1f3 [ 0.561064] worker_thread+0x1ac/0x25d [ 0.561069] ? process_scheduled_works+0x2e/0x2e [ 0.561074] kthread+0x10e/0x116 [ 0.561078] ? kthread_parkme+0x1c/0x1c [ 0.561083] ret_from_fork+0x22/0x30 [ 0.561087] ================================================================================ -- ~Randy Reported-by: Randy Dunlap <rdunlap@infradead.org> ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Intel-gfx] drm_modes: signed integer overflow 2020-10-22 3:13 drm_modes: signed integer overflow Randy Dunlap @ 2020-10-22 10:14 ` Ville Syrjälä 2020-10-23 15:14 ` Simon Ser 0 siblings, 1 reply; 5+ messages in thread From: Ville Syrjälä @ 2020-10-22 10:14 UTC (permalink / raw) To: Randy Dunlap; +Cc: dri-devel, LKML, David Airlie, Daniel Vetter, intel-gfx On Wed, Oct 21, 2020 at 08:13:43PM -0700, Randy Dunlap wrote: > Hi, > > With linux-next 20201021, when booting up, I am seeing this: > > [ 0.560896] UBSAN: signed-integer-overflow in ../drivers/gpu/drm/drm_modes.c:765:20 > [ 0.560903] 2376000 * 1000 cannot be represented in type 'int' Dang. Didn't realize these new crazy >8k modes have dotclocks reaching almost 6 GHz, which would overflow even u32. I guess we'll switch to 64bit maths. Now I wonder how many other places can hit this overflow in practice... > [ 0.560909] CPU: 3 PID: 7 Comm: kworker/u16:0 Not tainted 5.9.0-next-20201021 #2 > [ 0.560914] Hardware name: TOSHIBA PORTEGE R835/Portable PC, BIOS Version 4.10 01/08/2013 > [ 0.560924] Workqueue: events_unbound async_run_entry_fn > > [ 0.560930] Call Trace: > [ 0.560938] dump_stack+0x5e/0x74 > [ 0.560943] ubsan_epilogue+0x9/0x45 > [ 0.560948] handle_overflow+0x8b/0x98 > [ 0.560953] ? set_track+0x3f/0xad > [ 0.560958] __ubsan_handle_mul_overflow+0xe/0x10 > [ 0.560964] drm_mode_vrefresh+0x4a/0xbc > [ 0.560970] initcall i915_init+0x0/0x6a returned 0 after 116076 usecs > [ 0.560974] calling cn_proc_init+0x0/0x36 @ 1 > [ 0.560978] cea_mode_alternate_clock+0x11/0x62 > [ 0.560985] drm_match_cea_mode+0xc7/0x1e7 > [ 0.560987] initcall cn_proc_init+0x0/0x36 returned 0 after 3 usecs > [ 0.560990] calling topology_sysfs_init+0x0/0x2d @ 1 > [ 0.561000] drm_mode_validate_ycbcr420+0xd/0x48 > [ 0.561005] drm_helper_probe_single_connector_modes+0x6db/0x7da > [ 0.561012] drm_client_modeset_probe+0x225/0x143f > [ 0.561018] ? bitmap_fold+0x8a/0x8a > [ 0.561023] ? update_cfs_rq_load_avg+0x192/0x1a2 > [ 0.561029] __drm_fb_helper_initial_config_and_unlock+0x3f/0x5b7 > [ 0.561035] ? get_sd_balance_interval+0x1c/0x40 > [ 0.561040] drm_fb_helper_initial_config+0x48/0x4f > [ 0.561047] intel_fbdev_initial_config+0x13/0x23 > [ 0.561052] async_run_entry_fn+0x89/0x15c > [ 0.561058] process_one_work+0x15c/0x1f3 > [ 0.561064] worker_thread+0x1ac/0x25d > [ 0.561069] ? process_scheduled_works+0x2e/0x2e > [ 0.561074] kthread+0x10e/0x116 > [ 0.561078] ? kthread_parkme+0x1c/0x1c > [ 0.561083] ret_from_fork+0x22/0x30 > [ 0.561087] ================================================================================ > > -- > ~Randy > Reported-by: Randy Dunlap <rdunlap@infradead.org> > _______________________________________________ > Intel-gfx mailing list > Intel-gfx@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/intel-gfx -- Ville Syrjälä Intel ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Intel-gfx] drm_modes: signed integer overflow 2020-10-22 10:14 ` [Intel-gfx] " Ville Syrjälä @ 2020-10-23 15:14 ` Simon Ser 2020-10-23 15:27 ` Ville Syrjälä 0 siblings, 1 reply; 5+ messages in thread From: Simon Ser @ 2020-10-23 15:14 UTC (permalink / raw) To: Ville Syrjälä Cc: Randy Dunlap, David Airlie, intel-gfx, LKML, dri-devel, Pekka Paalanen On Thursday, October 22, 2020 12:14 PM, Ville Syrjälä <ville.syrjala@linux.intel.com> wrote: > On Wed, Oct 21, 2020 at 08:13:43PM -0700, Randy Dunlap wrote: > > > Hi, > > With linux-next 20201021, when booting up, I am seeing this: > > [ 0.560896] UBSAN: signed-integer-overflow in ../drivers/gpu/drm/drm_modes.c:765:20 > > [ 0.560903] 2376000 * 1000 cannot be represented in type 'int' > > Dang. Didn't realize these new crazy >8k modes have dotclocks reaching > almost 6 GHz, which would overflow even u32. I guess we'll switch to > 64bit maths. Now I wonder how many other places can hit this overflow > in practice... Can you provide an example of a full crazy >8k mode? I'm trying to get a fix for my user-space [1], and I'm wondering if int32_t is enough after dividing by mode->htotal. CC Pekka, just FYI (I think Weston has similar code). [1]: https://github.com/swaywm/wlroots/pull/2450 ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Intel-gfx] drm_modes: signed integer overflow 2020-10-23 15:14 ` Simon Ser @ 2020-10-23 15:27 ` Ville Syrjälä 2020-10-23 16:02 ` Simon Ser 0 siblings, 1 reply; 5+ messages in thread From: Ville Syrjälä @ 2020-10-23 15:27 UTC (permalink / raw) To: Simon Ser Cc: Randy Dunlap, David Airlie, intel-gfx, LKML, dri-devel, Pekka Paalanen On Fri, Oct 23, 2020 at 03:14:20PM +0000, Simon Ser wrote: > On Thursday, October 22, 2020 12:14 PM, Ville Syrjälä <ville.syrjala@linux.intel.com> wrote: > > > On Wed, Oct 21, 2020 at 08:13:43PM -0700, Randy Dunlap wrote: > > > > > Hi, > > > With linux-next 20201021, when booting up, I am seeing this: > > > [ 0.560896] UBSAN: signed-integer-overflow in ../drivers/gpu/drm/drm_modes.c:765:20 > > > [ 0.560903] 2376000 * 1000 cannot be represented in type 'int' > > > > Dang. Didn't realize these new crazy >8k modes have dotclocks reaching > > almost 6 GHz, which would overflow even u32. I guess we'll switch to > > 64bit maths. Now I wonder how many other places can hit this overflow > > in practice... > > Can you provide an example of a full crazy >8k mode? These are two extreme cases: /* 216 - 10240x4320@100Hz 64:27 */ { DRM_MODE("10240x4320", DRM_MODE_TYPE_DRIVER, 5940000, 10240, 12432, 12608, 13200, 0, 4320, 4336, 4356, 4500, 0, DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC), .picture_aspect_ratio = HDMI_PICTURE_ASPECT_64_27, }, /* 217 - 10240x4320@120Hz 64:27 */ { DRM_MODE("10240x4320", DRM_MODE_TYPE_DRIVER, 5940000, 10240, 10528, 10704, 11000, 0, 4320, 4336, 4356, 4500, 0, DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC), .picture_aspect_ratio = HDMI_PICTURE_ASPECT_64_27, } > I'm trying to get > a fix for my user-space [1], and I'm wondering if int32_t is enough > after dividing by mode->htotal. > > CC Pekka, just FYI (I think Weston has similar code). > > [1]: https://github.com/swaywm/wlroots/pull/2450 What's with those 1000000LL constants? Are you storing clock in Hz units? -- Ville Syrjälä Intel ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Intel-gfx] drm_modes: signed integer overflow 2020-10-23 15:27 ` Ville Syrjälä @ 2020-10-23 16:02 ` Simon Ser 0 siblings, 0 replies; 5+ messages in thread From: Simon Ser @ 2020-10-23 16:02 UTC (permalink / raw) To: Ville Syrjälä Cc: Randy Dunlap, David Airlie, intel-gfx, LKML, dri-devel, Pekka Paalanen On Friday, October 23, 2020 5:27 PM, Ville Syrjälä <ville.syrjala@linux.intel.com> wrote: > These are two extreme cases: Thanks! > > I'm trying to get > > a fix for my user-space 1, and I'm wondering if int32_t is enough > > after dividing by mode->htotal. > > CC Pekka, just FYI (I think Weston has similar code). > > What's with those 1000000LL constants? Are you storing > clock in Hz units? We're storing the vertical refresh rate in mHz (milli-Hertz). ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-10-23 16:02 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-10-22 3:13 drm_modes: signed integer overflow Randy Dunlap 2020-10-22 10:14 ` [Intel-gfx] " Ville Syrjälä 2020-10-23 15:14 ` Simon Ser 2020-10-23 15:27 ` Ville Syrjälä 2020-10-23 16:02 ` Simon Ser
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).