Skip to contentSkip to conversation

drm: zynqmp_dp: Fix integer overflow in zynqmp_dp_rate_get()

PATCH In review Karol Przybylski 3 participants 3 messages Dec 15, 2024 – Dec 16, 2024

Subsystems (5)
Stable branch DRM drivers DRM misc Arm/Zynq architecture +1 more subsystems
lore
Share & tools
lore

Karol Przybylski

author
#0 lore raw

PATCH v3 1/1 drm: zynqmp_dp: Fix integer overflow in zynqmp_dp_rate_get()

This patch fixes a potential integer overflow in the zynqmp_dp_rate_get()

The issue comes up when the expression drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000 is evaluated using 32-bit Now the constant is a compatible 64-bit type.

Resolves coverity issues: CID 1636340 and CID 1635811

Cc [email protected]
Fixes 28edaacb821c6 ("drm: zynqmp_dp: Add debugfs interface for compliance testing")
Signed-off-by Karol Przybylski <[email protected]>

---
Changes from previous versions:
Added Fixes tag
Added Cc for stable kernel version
Fixed formatting

 drivers/gpu/drm/xlnx/zynqmp_dp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xlnx/zynqmp_dp.c +1 -1
index 25c5dc61ee88..56a261a40ea3 100644
@@ -2190,7 +2190,7 @@ static int zynqmp_dp_rate_get(void *data, u64 *val)
 	struct zynqmp_dp *dp = data;
 
 	mutex_lock(&dp->lock);
-	*val = drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000;
+	*val = drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000ULL;
 	mutex_unlock(&dp->lock);
 	return 0;
 }
Signature · 1 line
2.34.1
maintainer Reviewed-by on v3 1/1
#1 lore raw

Ho Karol,

Thank you for the patch.

Quoted 11 lines · Karol Przybylski

This patch fixes a potential integer overflow in the zynqmp_dp_rate_get()

The issue comes up when the expression drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000 is evaluated using 32-bit Now the constant is a compatible 64-bit type.

Resolves coverity issues: CID 1636340 and CID 1635811

Cc [email protected]
Fixes 28edaacb821c6 ("drm: zynqmp_dp: Add debugfs interface for compliance testing")
Signed-off-by Karol Przybylski <[email protected]>
Reviewed-by Laurent Pinchart <[email protected]>
Quoted 22 lines

---
Changes from previous versions:
Added Fixes tag
Added Cc for stable kernel version
Fixed formatting

 drivers/gpu/drm/xlnx/zynqmp_dp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xlnx/zynqmp_dp.c +1 -1
index 25c5dc61ee88..56a261a40ea3 100644
@@ -2190,7 +2190,7 @@ static int zynqmp_dp_rate_get(void *data, u64 *val)
 	struct zynqmp_dp *dp = data;
 
 	mutex_lock(&dp->lock);
-	*val = drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000;
+	*val = drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000ULL;
 	mutex_unlock(&dp->lock);
 	return 0;
 }
Signature · 3 lines
Regards,

Laurent Pinchart
maintainer
#2 lore raw
In reply to Karol Przybylski

Hi,

Quoted 25 lines · Karol Przybylski

This patch fixes a potential integer overflow in the zynqmp_dp_rate_get()

The issue comes up when the expression drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000 is evaluated using 32-bit Now the constant is a compatible 64-bit type.

Resolves coverity issues: CID 1636340 and CID 1635811

Cc [email protected]
Fixes 28edaacb821c6 ("drm: zynqmp_dp: Add debugfs interface for compliance testing")
Signed-off-by Karol Przybylski <[email protected]>

---
Changes from previous versions:
Added Fixes tag
Added Cc for stable kernel version
Fixed formatting

  drivers/gpu/drm/xlnx/zynqmp_dp.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xlnx/zynqmp_dp.c +0 -0
index 25c5dc61ee88..56a261a40ea3 100644

drivers/gpu/drm/xlnx/zynqmp_dp.c static int zynqmp_dp_rate_get(void *data, u64 *val) · line 2196

Quoted 8 lines
drivers/gpu/drm/xlnx/zynqmp_dp.c +1 -1
@@ -2190,7 +2190,7 @@ static int zynqmp_dp_rate_get(void *data, u64 *val)
  	struct zynqmp_dp *dp = data;
 
  	mutex_lock(&dp->lock);
-	*val = drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000;
+	*val = drm_dp_bw_code_to_link_rate(dp->test.bw_code) * 10000ULL;
  	mutex_unlock(&dp->lock);
  	return 0;
  }

Thanks, pushed to drm-misc-next.

Tomi