From: Colin King <colin.king@canonical.com> To: Hans Verkuil <hverkuil@xs4all.nl>, Mauro Carvalho Chehab <mchehab@kernel.org>, linux-media@vger.kernel.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH][next][V2] media: vivid: fix potential integer overflow on left shift Date: Wed, 26 Jun 2019 15:47:46 +0100 [thread overview] Message-ID: <20190626144746.27607-1-colin.king@canonical.com> (raw) From: Colin Ian King <colin.king@canonical.com> There is a potential integer overflow when int 2 is left shifted as this is evaluated using 32 bit arithmetic but is being used in a context that expects an expression of type s64. Fix this by shifting 2ULL to avoid a 32 bit overflow. Addresses-Coverity: ("Unintentional integer overflow") Fixes: 8a99e9faa131 ("media: vivid: add HDMI (dis)connect RX emulation") Fixes: 79a792dafac6 ("media: vivid: add HDMI (dis)connect TX emulation") Signed-off-by: Colin Ian King <colin.king@canonical.com> --- V2: use intermediate variables for the shifted expression to make code a bit more readable. --- drivers/media/platform/vivid/vivid-ctrls.c | 24 +++++++++++----------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/drivers/media/platform/vivid/vivid-ctrls.c b/drivers/media/platform/vivid/vivid-ctrls.c index 3e916c8befb7..df1598e81c7a 100644 --- a/drivers/media/platform/vivid/vivid-ctrls.c +++ b/drivers/media/platform/vivid/vivid-ctrls.c @@ -1613,6 +1613,8 @@ int vivid_create_controls(struct vivid_dev *dev, bool show_ccs_cap, } if (dev->num_hdmi_inputs) { + s64 hdmi_input = (2ULL << (dev->num_hdmi_inputs - 1)) - 1; + dev->ctrl_dv_timings_signal_mode = v4l2_ctrl_new_custom(hdl_vid_cap, &vivid_ctrl_dv_timings_signal_mode, NULL); @@ -1633,12 +1635,13 @@ int vivid_create_controls(struct vivid_dev *dev, bool show_ccs_cap, V4L2_CID_DV_RX_RGB_RANGE, V4L2_DV_RGB_RANGE_FULL, 0, V4L2_DV_RGB_RANGE_AUTO); dev->ctrl_rx_power_present = v4l2_ctrl_new_std(hdl_vid_cap, - NULL, V4L2_CID_DV_RX_POWER_PRESENT, 0, - (2 << (dev->num_hdmi_inputs - 1)) - 1, 0, - (2 << (dev->num_hdmi_inputs - 1)) - 1); + NULL, V4L2_CID_DV_RX_POWER_PRESENT, 0, hdmi_input, + 0, hdmi_input); } if (dev->num_hdmi_outputs) { + s64 hdmi_output = (2ULL << (dev->num_hdmi_outputs - 1)) - 1; + /* * We aren't doing anything with this at the moment, but * HDMI outputs typically have this controls. @@ -1652,17 +1655,14 @@ int vivid_create_controls(struct vivid_dev *dev, bool show_ccs_cap, dev->ctrl_display_present = v4l2_ctrl_new_custom(hdl_vid_out, &vivid_ctrl_display_present, NULL); dev->ctrl_tx_hotplug = v4l2_ctrl_new_std(hdl_vid_out, - NULL, V4L2_CID_DV_TX_HOTPLUG, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1); + NULL, V4L2_CID_DV_TX_HOTPLUG, 0, hdmi_output, + 0, hdmi_output); dev->ctrl_tx_rxsense = v4l2_ctrl_new_std(hdl_vid_out, - NULL, V4L2_CID_DV_TX_RXSENSE, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1); + NULL, V4L2_CID_DV_TX_RXSENSE, 0, hdmi_output, + 0, hdmi_output); dev->ctrl_tx_edid_present = v4l2_ctrl_new_std(hdl_vid_out, - NULL, V4L2_CID_DV_TX_EDID_PRESENT, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1); + NULL, V4L2_CID_DV_TX_EDID_PRESENT, 0, hdmi_output, + 0, hdmi_output); } if ((dev->has_vid_cap && dev->has_vid_out) || (dev->has_vbi_cap && dev->has_vbi_out)) -- 2.20.1
WARNING: multiple messages have this Message-ID (diff)
From: Colin King <colin.king@canonical.com> To: Hans Verkuil <hverkuil@xs4all.nl>, Mauro Carvalho Chehab <mchehab@kernel.org>, linux-media@vger.kernel.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH][next][V2] media: vivid: fix potential integer overflow on left shift Date: Wed, 26 Jun 2019 14:47:46 +0000 [thread overview] Message-ID: <20190626144746.27607-1-colin.king@canonical.com> (raw) From: Colin Ian King <colin.king@canonical.com> There is a potential integer overflow when int 2 is left shifted as this is evaluated using 32 bit arithmetic but is being used in a context that expects an expression of type s64. Fix this by shifting 2ULL to avoid a 32 bit overflow. Addresses-Coverity: ("Unintentional integer overflow") Fixes: 8a99e9faa131 ("media: vivid: add HDMI (dis)connect RX emulation") Fixes: 79a792dafac6 ("media: vivid: add HDMI (dis)connect TX emulation") Signed-off-by: Colin Ian King <colin.king@canonical.com> --- V2: use intermediate variables for the shifted expression to make code a bit more readable. --- drivers/media/platform/vivid/vivid-ctrls.c | 24 +++++++++++----------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/drivers/media/platform/vivid/vivid-ctrls.c b/drivers/media/platform/vivid/vivid-ctrls.c index 3e916c8befb7..df1598e81c7a 100644 --- a/drivers/media/platform/vivid/vivid-ctrls.c +++ b/drivers/media/platform/vivid/vivid-ctrls.c @@ -1613,6 +1613,8 @@ int vivid_create_controls(struct vivid_dev *dev, bool show_ccs_cap, } if (dev->num_hdmi_inputs) { + s64 hdmi_input = (2ULL << (dev->num_hdmi_inputs - 1)) - 1; + dev->ctrl_dv_timings_signal_mode = v4l2_ctrl_new_custom(hdl_vid_cap, &vivid_ctrl_dv_timings_signal_mode, NULL); @@ -1633,12 +1635,13 @@ int vivid_create_controls(struct vivid_dev *dev, bool show_ccs_cap, V4L2_CID_DV_RX_RGB_RANGE, V4L2_DV_RGB_RANGE_FULL, 0, V4L2_DV_RGB_RANGE_AUTO); dev->ctrl_rx_power_present = v4l2_ctrl_new_std(hdl_vid_cap, - NULL, V4L2_CID_DV_RX_POWER_PRESENT, 0, - (2 << (dev->num_hdmi_inputs - 1)) - 1, 0, - (2 << (dev->num_hdmi_inputs - 1)) - 1); + NULL, V4L2_CID_DV_RX_POWER_PRESENT, 0, hdmi_input, + 0, hdmi_input); } if (dev->num_hdmi_outputs) { + s64 hdmi_output = (2ULL << (dev->num_hdmi_outputs - 1)) - 1; + /* * We aren't doing anything with this at the moment, but * HDMI outputs typically have this controls. @@ -1652,17 +1655,14 @@ int vivid_create_controls(struct vivid_dev *dev, bool show_ccs_cap, dev->ctrl_display_present = v4l2_ctrl_new_custom(hdl_vid_out, &vivid_ctrl_display_present, NULL); dev->ctrl_tx_hotplug = v4l2_ctrl_new_std(hdl_vid_out, - NULL, V4L2_CID_DV_TX_HOTPLUG, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1); + NULL, V4L2_CID_DV_TX_HOTPLUG, 0, hdmi_output, + 0, hdmi_output); dev->ctrl_tx_rxsense = v4l2_ctrl_new_std(hdl_vid_out, - NULL, V4L2_CID_DV_TX_RXSENSE, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1); + NULL, V4L2_CID_DV_TX_RXSENSE, 0, hdmi_output, + 0, hdmi_output); dev->ctrl_tx_edid_present = v4l2_ctrl_new_std(hdl_vid_out, - NULL, V4L2_CID_DV_TX_EDID_PRESENT, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1, 0, - (2 << (dev->num_hdmi_outputs - 1)) - 1); + NULL, V4L2_CID_DV_TX_EDID_PRESENT, 0, hdmi_output, + 0, hdmi_output); } if ((dev->has_vid_cap && dev->has_vid_out) || (dev->has_vbi_cap && dev->has_vbi_out)) -- 2.20.1
next reply other threads:[~2019-06-26 14:48 UTC|newest] Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-06-26 14:47 Colin King [this message] 2019-06-26 14:47 ` [PATCH][next][V2] media: vivid: fix potential integer overflow on left shift Colin King 2019-06-27 7:15 ` walter harms 2019-06-27 7:15 ` walter harms 2019-06-27 7:22 ` Hans Verkuil 2019-06-27 7:22 ` Hans Verkuil
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190626144746.27607-1-colin.king@canonical.com \ --to=colin.king@canonical.com \ --cc=hverkuil@xs4all.nl \ --cc=kernel-janitors@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-media@vger.kernel.org \ --cc=mchehab@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.