Skip to contentSkip to conversation

iommu/vt-d: shift wrapping bug in prq_event_thread()

PATCH Applied Dan Carpenter 2 participants 2 messages Oct 15, 2015 – Oct 16, 2015

Subsystems (2)
Kernel janitors IOMMU
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 iommu/vt-d: shift wrapping bug in prq_event_thread()

The "req->addr" variable is a bit field declared as "u64 addr:52;". The "address" variable is a u64. We need to cast "req->addr" to a u64 before the shift or the result is truncated to 52 bits.

Fixes 0b9252a34858 ('iommu/vt-d: Implement page request handling')
Signed-off-by Dan Carpenter <[email protected]>

---
Also does this code work if PAGE_SHIFT is more than 12? (I am a newbie so this is not rhetorical, I don't know the answer).

drivers/iommu/intel-svm.c +1 -1
index ba88889..19aa67b 100644
@@ -395,7 +395,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
 		req = &iommu->prq[head / sizeof(*req)];
 
 		result = QI_RESP_INVALID;
-		address = req->addr << PAGE_SHIFT;
+		address = (u64)req->addr << PAGE_SHIFT;
 		if (!req->pasid_present) {
 			pr_err("%s: Page request without PASID: %08llx %08llx\n",
 			       iommu->name, ((unsigned long long *)req)[0],
Applied
#1 lore raw
Quoted 6 lines · Dan Carpenter

The "req->addr" variable is a bit field declared as "u64 addr:52;". The "address" variable is a u64. We need to cast "req->addr" to a u64 before the shift or the result is truncated to 52 bits.

Fixes 0b9252a34858 ('iommu/vt-d: Implement page request handling')
Signed-off-by Dan Carpenter <[email protected]>

Applied; thanks.

Quoted 2 lines

Also does this code work if PAGE_SHIFT is more than 12? (I am a newbie so this is not rhetorical, I don't know the answer).

Er, no it doesn't. That should have been VTD_PAGE_SHIFT, not PAGE_SHIFT — and then it *will* always be 12. Thanks for pointing it out.

Signature · 2 lines
David Woodhouse                            Open Source Technology Centre
[email protected]                              Intel Corporation