From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C912DCA5FAC for ; Wed, 30 Sep 2026 11:55:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:MIME-Version: Content-Transfer-Encoding:Content-Type:References:In-Reply-To:Date:Cc:To:From :Subject:Message-ID:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=DOZsR/ac7GbUoOWLmXgbXKPZIPwkoKZ1eUqerXVBB9U=; b=ZsUJwv49ju1Rp6u5OfhkHoUbPV DM/wy5Cm1Krg/sPh24xiFxSYS6rKXCdzwxgtIEzBAQNo7h+C6NmTMIaajef0l8rQPpCtWs9ei3W2Q vKFP6I1NtbugRVlAJCo4obFaJPgprQjVbTdrU7BaVQe6azN+s9sPDJUfWJa8UtvBeV7evn/c2F5a+ sLWXB79XFRDxOzAQwLL8e1rEEZK+TjiQQiylnP36Z8KWsbLjbFP0YN257Jd4F7OV1/AXSoAwnNVzV oXL4Fm2QEov13ynQ5ndZ9DMcnA9AFoiNV2s5hPYhjDujRBxCNWdG6z6cyBiWsBaIwCUZ2x1p1lP3k XJoevhjw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1xBsuI-00000005wJo-3aDX; Wed, 30 Sep 2026 11:55:31 +0000 Received: from xs1.mindbit.ro ([80.86.107.70] helo=mail.mindbit.ro) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1xBsuE-00000005wHr-2ktg for linux-arm-kernel@lists.infradead.org; Wed, 30 Sep 2026 11:55:29 +0000 Received: from dog.kanata.rendec.net (pool-174-112-193-187.cpe.net.cable.rogers.com [174.112.193.187]) by mail.mindbit.ro (Postfix) with ESMTPSA id EE180D09CC; Wed, 30 Sep 2026 14:55:18 +0300 (EEST) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.mindbit.ro EE180D09CC DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rendec.net; s=default; t=1790769320; bh=DOZsR/ac7GbUoOWLmXgbXKPZIPwkoKZ1eUqerXVBB9U=; h=Subject:From:To:Cc:Date:In-Reply-To:References:From; b=nSerLCyr1/edPv0lOSG8NY0WAiOGlubgWbYKYDzQkqp2ZTQByndWc4KTIJrKSqC5z iB8S4PmUaan0R2vcUuCtzH10cmAiwD3yiNrPGsLFS7X7ZLDHEA/nJGBV77t6Dc/I6b I4lWxZ6kkgr7Sw+sBZldG6djotXJ4eN4D/1N5Kt+IQhkrzfJ/rjQSU4e45l8fHgiDc Ry4FPDO1rlkKaVFyLzqRx63vpbbSOW74zIUbNOVHyDPuPZYg8U1xl9Gx7dK1bNs7Fw vpzPa0S7AanAVDUDij/vDd/5WQXqjIAUm9DFZk0KRsLuAcTQvglUf7szYFuq7a+Qhu tw36X4301Gc2w== Message-ID: <5114dccecac18da35a9c502d04b1ca296a2cbcaf.camel@rendec.net> Subject: Re: [PATCH v5] irqchip/gic: Fix UBSAN shift-out-of-bounds in GIC helpers From: Radu Rendec To: Zhu Ling , maz@kernel.org, tglx@kernel.org Cc: zenghui.yu@linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Date: Wed, 30 Sep 2026 07:55:17 -0400 In-Reply-To: <20260929031050.16988-1-zhuling2709@phytium.com.cn> References: <20260928013209.7242-1-zhuling2709@phytium.com.cn> <20260929031050.16988-1-zhuling2709@phytium.com.cn> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.3 (3.58.3-1.fc43) MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260930_045527_208117_90B1323B X-CRM114-Status: GOOD ( 22.50 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Tue, 2026-09-29 at 11:10 +0800, Zhu Ling wrote: > When running with UBSAN enabled, enabling a GPIO controller that uses a > GIC interrupt as its parent triggers several shift-out-of-bounds warnings= : >=20 > =C2=A0 shift-out-of-bounds in drivers/irqchip/irq-gic-common.c:50:21 > =C2=A0 left shift of 2 by 30 places cannot be represented in type 'int' >=20 > Similar reports are emitted from gic_poke_irq() and gic_peek_irq() in > drivers/irqchip/irq-gic-v3.c. The corresponding GICv2 helpers use the > same signed-shift pattern. These masks are generated by shifting signed > integer constants, which invokes undefined behavior when bit 31 is > selected. >=20 > Use BIT() to generate the masks with an unsigned type and make their > intent explicit. >=20 > Fixes: f27ecacc54cc ("[ARM] Add support for ARM GIC") > Fixes: 5c0c1f08abf0 ("ARM: 6150/1: gic: implement set_type") > Fixes: 021f653791ad ("irqchip: gic-v3: Initial support for GICv3") > Reviewed-by: Zenghui Yu (Huawei) > Acked-by: Marc Zyngier > Signed-off-by: Zhu Ling Reviewed-by: Radu Rendec > --- > Changes in v5: > - Correct the GICv2 and GICv3 helper Fixes tags to point to the commits > =C2=A0 that originally introduced the signed shifts. Thanks! > - Add Zenghui's Reviewed-by and Marc's Acked-by tags. >=20 > Changes in v4: > - Add Fixes tags for the commits that introduced the affected masks. >=20 > Changes in v3: > - Fix the same issue in the GICv2 gic_poke_irq() and gic_peek_irq() > =C2=A0 helpers, as pointed out by Zenghui. >=20 > Changes in v2: > - Use BIT() instead of explicit unsigned shifts, as suggested by Marc. > - Drop the redundant introductory text from the email. > - Update the author email address. >=20 > Link: https://lore.kernel.org/r/2fJDwUUYdEf2_eaRa041L9xkT8RkSWFeo7euOnqMb= bPhUatLlEaAvGfB6sOspDmXaxO87Eh7bQLV9UolyjbMtZBT1wB2UGypjPOo0Z-RC0Q=3D@proto= n.me > --- > =C2=A0drivers/irqchip/irq-gic-common.c | 2 +- > =C2=A0drivers/irqchip/irq-gic-v3.c=C2=A0=C2=A0=C2=A0=C2=A0 | 4 ++-- > =C2=A0drivers/irqchip/irq-gic.c=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= | 4 ++-- > =C2=A03 files changed, 5 insertions(+), 5 deletions(-) >=20 > diff --git a/drivers/irqchip/irq-gic-common.c b/drivers/irqchip/irq-gic-c= ommon.c > index c776f9142610..8bd1eaa54295 100644 > --- a/drivers/irqchip/irq-gic-common.c > +++ b/drivers/irqchip/irq-gic-common.c > @@ -48,7 +48,7 @@ void gic_enable_quirks(u32 iidr, const struct gic_quirk= *quirks, > =C2=A0int gic_configure_irq(unsigned int irq, unsigned int type, > =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 void __iomem *base) > =C2=A0{ > - u32 confmask =3D 0x2 << ((irq % 16) * 2); > + u32 confmask =3D BIT(((irq % 16) * 2) + 1); > =C2=A0 u32 confoff =3D (irq / 16) * 4; > =C2=A0 u32 val, oldval; > =C2=A0 int ret =3D 0; > diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c > index 6e1fa5b247fc..15110d47ddb0 100644 > --- a/drivers/irqchip/irq-gic-v3.c > +++ b/drivers/irqchip/irq-gic-v3.c > @@ -457,7 +457,7 @@ static int gic_peek_irq(struct irq_data *d, u32 offse= t) > =C2=A0 u32 index, mask; > =C2=A0 > =C2=A0 offset =3D convert_offset_index(d, offset, &index); > - mask =3D 1 << (index % 32); > + mask =3D BIT(index % 32); > =C2=A0 > =C2=A0 if (gic_irq_in_rdist(d)) > =C2=A0 base =3D gic_data_rdist_sgi_base(); > @@ -473,7 +473,7 @@ static void gic_poke_irq(struct irq_data *d, u32 offs= et) > =C2=A0 u32 index, mask; > =C2=A0 > =C2=A0 offset =3D convert_offset_index(d, offset, &index); > - mask =3D 1 << (index % 32); > + mask =3D BIT(index % 32); > =C2=A0 > =C2=A0 if (gic_irq_in_rdist(d)) > =C2=A0 base =3D gic_data_rdist_sgi_base(); > diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c > index f6bc29f515fb..fb7a55f5b394 100644 > --- a/drivers/irqchip/irq-gic.c > +++ b/drivers/irqchip/irq-gic.c > @@ -178,14 +178,14 @@ static inline bool cascading_gic_irq(struct irq_dat= a *d) > =C2=A0 */ > =C2=A0static void gic_poke_irq(struct irq_data *d, u32 offset) > =C2=A0{ > - u32 mask =3D 1 << (irqd_to_hwirq(d) % 32); > + u32 mask =3D BIT(irqd_to_hwirq(d) % 32); > =C2=A0 > =C2=A0 writel_relaxed(mask, gic_dist_base(d) + offset + (irqd_to_hwirq(d)= / 32) * 4); > =C2=A0} > =C2=A0 > =C2=A0static int gic_peek_irq(struct irq_data *d, u32 offset) > =C2=A0{ > - u32 mask =3D 1 << (irqd_to_hwirq(d) % 32); > + u32 mask =3D BIT(irqd_to_hwirq(d) % 32); > =C2=A0 > =C2=A0 return !!(readl_relaxed(gic_dist_base(d) + offset + (irqd_to_hwirq= (d) / 32) * 4) & mask); > =C2=A0}