* [PATCH][next] drm/nouveau/gsp: Fix potential integer overflow on integer shifts
@ 2025-05-22 13:15 Colin Ian King
2025-06-13 15:45 ` Danilo Krummrich
0 siblings, 1 reply; 2+ messages in thread
From: Colin Ian King @ 2025-05-22 13:15 UTC (permalink / raw)
To: Lyude Paul, Danilo Krummrich, David Airlie, Simona Vetter,
Dave Airlie, Timur Tabi, Ben Skeggs, dri-devel, nouveau
Cc: kernel-janitors, linux-kernel
The left shift int 32 bit integer constants 1 is evaluated using 32 bit
arithmetic and then assigned to a 64 bit unsigned integer. In the case
where the shift is 32 or more this can lead to an overflow. Avoid this
by shifting using the BIT_ULL macro instead.
Fixes: 6c3ac7bcfcff ("drm/nouveau/gsp: support deeper page tables in COPY_SERVER_RESERVED_PDES")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
---
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/vmm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/vmm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/vmm.c
index 52f2e5f14517..f25ea610cd99 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/vmm.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/vmm.c
@@ -121,7 +121,7 @@ r535_mmu_vaspace_new(struct nvkm_vmm *vmm, u32 handle, bool external)
page_shift -= desc->bits;
ctrl->levels[i].physAddress = pd->pt[0]->addr;
- ctrl->levels[i].size = (1 << desc->bits) * desc->size;
+ ctrl->levels[i].size = BIT_ULL(desc->bits) * desc->size;
ctrl->levels[i].aperture = 1;
ctrl->levels[i].pageShift = page_shift;
--
2.49.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH][next] drm/nouveau/gsp: Fix potential integer overflow on integer shifts
2025-05-22 13:15 [PATCH][next] drm/nouveau/gsp: Fix potential integer overflow on integer shifts Colin Ian King
@ 2025-06-13 15:45 ` Danilo Krummrich
0 siblings, 0 replies; 2+ messages in thread
From: Danilo Krummrich @ 2025-06-13 15:45 UTC (permalink / raw)
To: Colin Ian King
Cc: Lyude Paul, David Airlie, Simona Vetter, Dave Airlie, Timur Tabi,
Ben Skeggs, dri-devel, nouveau, kernel-janitors, linux-kernel
On 5/22/25 3:15 PM, Colin Ian King wrote:
> The left shift int 32 bit integer constants 1 is evaluated using 32 bit
> arithmetic and then assigned to a 64 bit unsigned integer. In the case
> where the shift is 32 or more this can lead to an overflow. Avoid this
> by shifting using the BIT_ULL macro instead.
>
> Fixes: 6c3ac7bcfcff ("drm/nouveau/gsp: support deeper page tables in COPY_SERVER_RESERVED_PDES")
>
> Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Applied to drm-misc-fixes, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-06-13 15:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-05-22 13:15 [PATCH][next] drm/nouveau/gsp: Fix potential integer overflow on integer shifts Colin Ian King
2025-06-13 15:45 ` Danilo Krummrich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).