[PATCH] Fix an overflow in range_to_mtrr func

[PATCH] Fix an overflow in range_to_mtrr func

[Zhenzhong Duan]

When boot x86_64 kernel on sun G5+ with 4T mem, see an overflow in mtrr cleanup as below.

*BAD*gran_size: 2G      chunk_size: 2G  num_reg: 10     lose cover RAM:
-18014398505283592M

This is because 1<<31 sign extended.
Use explicit type conversion to force a 64bit constant to fix it.
Useful for mem larger than or equal to 4T.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
---
 arch/x86/kernel/cpu/mtrr/cleanup.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
index ac140c7..853a4c6 100644
--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
+++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
@@ -266,7 +266,7 @@ range_to_mtrr(unsigned int reg, unsigned long range_startk,
 		if (align > max_align)
 			align = max_align;
 
-		sizek = 1 << align;
+		sizek = (unsigned long)1 << align;
 		if (debug_print) {
 			char start_factor = 'K', size_factor = 'K';
 			unsigned long start_base, size_base;
-- 
1.7.3

Re: [PATCH] Fix an overflow in range_to_mtrr func

[Yinghai Lu]

On Mon, May 28, 2012 at 5:29 AM, Zhenzhong Duan
<zhenzhong.duan@oracle.com> wrote:
> When boot x86_64 kernel on sun G5+ with 4T mem, see an overflow in mtrr cleanup as below.
>
> *BAD*gran_size: 2G      chunk_size: 2G  num_reg: 10     lose cover RAM:
> -18014398505283592M
>
> This is because 1<<31 sign extended.
> Use explicit type conversion to force a 64bit constant to fix it.
> Useful for mem larger than or equal to 4T.
>
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
> ---
>  arch/x86/kernel/cpu/mtrr/cleanup.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
> index ac140c7..853a4c6 100644
> --- a/arch/x86/kernel/cpu/mtrr/cleanup.c
> +++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
> @@ -266,7 +266,7 @@ range_to_mtrr(unsigned int reg, unsigned long range_startk,
>                if (align > max_align)
>                        align = max_align;
>
> -               sizek = 1 << align;
> +               sizek = (unsigned long)1 << align;

how about

            sizek = 1UL << align;


>                if (debug_print) {
>                        char start_factor = 'K', size_factor = 'K';
>                        unsigned long start_base, size_base;
> --
> 1.7.3
>

[PATCH v2] Fix an overflow in range_to_mtrr func

[zhenzhong.duan]

When boot on sun G5+ with 4T mem, see an overflow in mtrr cleanup as below.

*BAD*gran_size: 2G      chunk_size: 2G  num_reg: 10     lose cover RAM:
-18014398505283592M

This is because 1<<31 sign extended. Use 64bit constant to fix it.
Useful for mem larger than or equal to 4T.

-v2: Use 64bit constant instead of explicit type conversion as suggested
by Yinghai. Description updated too.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
---
  arch/x86/kernel/cpu/mtrr/cleanup.c |    2 +-
  1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c
b/arch/x86/kernel/cpu/mtrr/cleanup.c
index ac140c7..853a4c6 100644
--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
+++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
@@ -266,7 +266,7 @@ range_to_mtrr(unsigned int reg, unsigned long
range_startk,
  		if (align > max_align)
  			align = max_align;

-		sizek = 1 << align;
+		sizek = 1UL << align;
  		if (debug_print) {
  			char start_factor = 'K', size_factor = 'K';
  			unsigned long start_base, size_base;
-- 1.7.3

[tip:x86/urgent] x86, mtrr: Fix a type overflow in range_to_mtrr func

[tip-bot for zhenzhong.duan]

Commit-ID:  2da06af8106f8f35318bb084baf8448797ef058a
Gitweb:     http://git.kernel.org/tip/2da06af8106f8f35318bb084baf8448797ef058a
Author:     zhenzhong.duan <zhenzhong.duan@oracle.com>
AuthorDate: Wed, 30 May 2012 12:52:15 +0800
Committer:  H. Peter Anvin <hpa@zytor.com>
CommitDate: Wed, 30 May 2012 14:37:00 -0700

x86, mtrr: Fix a type overflow in range_to_mtrr func

When boot on sun G5+ with 4T mem, see an overflow in mtrr cleanup as below.

*BAD*gran_size: 2G      chunk_size: 2G  num_reg: 10     lose cover RAM:
-18014398505283592M

This is because 1<<31 sign extended. Use an unsigned long constant to
fix it.  Useful for mem larger than or equal to 4T.

-v2: Use 64bit constant instead of explicit type conversion as suggested
by Yinghai. Description updated too.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Link: http://lkml.kernel.org/r/4FC5A77F.6060505@oracle.com
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
---
 arch/x86/kernel/cpu/mtrr/cleanup.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kernel/cpu/mtrr/cleanup.c b/arch/x86/kernel/cpu/mtrr/cleanup.c
index ac140c7..bdda2e6 100644
--- a/arch/x86/kernel/cpu/mtrr/cleanup.c
+++ b/arch/x86/kernel/cpu/mtrr/cleanup.c
@@ -266,7 +266,7 @@ range_to_mtrr(unsigned int reg, unsigned long range_startk,
 		if (align > max_align)
 			align = max_align;
 
-		sizek = 1 << align;
+		sizek = 1UL << align;
 		if (debug_print) {
 			char start_factor = 'K', size_factor = 'K';
 			unsigned long start_base, size_base;