• Nikita Zhandarovich's avatar
    drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets · 3fbaf475
    Nikita Zhandarovich authored
    Several cs track offsets (such as 'track->db_s_read_offset')
    either are initialized with or plainly take big enough values that,
    once shifted 8 bits left, may be hit with integer overflow if the
    resulting values end up going over u32 limit.
    
    Same goes for a few instances of 'surf.layer_size * mslice'
    multiplications that are added to 'offset' variable - they may
    potentially overflow as well and need to be validated properly.
    
    While some debug prints in this code section take possible overflow
    issues into account, simply casting to (unsigned long) may be
    erroneous in its own way, as depending on CPU architecture one is
    liable to get different results.
    
    Fix said problems by:
     - casting 'offset' to fixed u64 data type instead of
     ambiguous unsigned long.
     - casting one of the operands in vulnerable to integer
     overflow cases to u64.
     - adjust format specifiers in debug prints to properly
     represent 'offset' values.
    
    Found by Linux Verification Center (linuxtesting.org) with static
    analysis tool SVACE.
    
    Fixes: 285484e2 ("drm/radeon: add support for evergreen/ni tiling informations v11")
    Signed-off-by: default avatarNikita Zhandarovich <n.zhandarovich@fintech.ru>
    Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
    3fbaf475
evergreen_cs.c 104 KB