| Message ID | 20240312095441.3684038-1-arun.r.murthy@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/xe/display: fix potential overflow when multiplying 2 u32 | expand |
On Tue, Mar 12, 2024 at 03:24:41PM +0530, Arun R Murthy wrote: > Multiplying XE_PAGE_SIZE with another u32 and the product stored in > u64 can potentially lead to overflow. Change one of the value to u64 so > as to perform 64 bit arithmetic operation as the product is u64. These should never get that big. > > Signed-off-by: Arun R Murthy <arun.r.murthy@intel.com> > --- > drivers/gpu/drm/xe/display/xe_fb_pin.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/drivers/gpu/drm/xe/display/xe_fb_pin.c b/drivers/gpu/drm/xe/display/xe_fb_pin.c > index 722c84a56607..c9d26345ae6e 100644 > --- a/drivers/gpu/drm/xe/display/xe_fb_pin.c > +++ b/drivers/gpu/drm/xe/display/xe_fb_pin.c > @@ -29,7 +29,7 @@ write_dpt_rotated(struct xe_bo *bo, struct iosys_map *map, u32 *dpt_ofs, u32 bo_ > u32 src_idx = src_stride * (height - 1) + column + bo_ofs; > > for (row = 0; row < height; row++) { > - u64 pte = ggtt->pt_ops->pte_encode_bo(bo, src_idx * XE_PAGE_SIZE, > + u64 pte = ggtt->pt_ops->pte_encode_bo(bo, src_idx * (u64)XE_PAGE_SIZE, mul_u32_u32() may generate better code due to compiler fails. > xe->pat.idx[XE_CACHE_WB]); Rather surprising to see WB in any display code. Is this stuff actually working? > > iosys_map_wr(map, *dpt_ofs, u64, pte); > @@ -61,7 +61,7 @@ write_dpt_remapped(struct xe_bo *bo, struct iosys_map *map, u32 *dpt_ofs, > > for (column = 0; column < width; column++) { > iosys_map_wr(map, *dpt_ofs, u64, > - pte_encode_bo(bo, src_idx * XE_PAGE_SIZE, > + pte_encode_bo(bo, src_idx * (u64)XE_PAGE_SIZE, > xe->pat.idx[XE_CACHE_WB])); > > *dpt_ofs += 8; > @@ -118,7 +118,7 @@ static int __xe_pin_fb_vma_dpt(struct intel_framebuffer *fb, > u32 x; > > for (x = 0; x < size / XE_PAGE_SIZE; x++) { > - u64 pte = ggtt->pt_ops->pte_encode_bo(bo, x * XE_PAGE_SIZE, > + u64 pte = ggtt->pt_ops->pte_encode_bo(bo, x * (u64)XE_PAGE_SIZE, > xe->pat.idx[XE_CACHE_WB]); > > iosys_map_wr(&dpt->vmap, x * 8, u64, pte); > @@ -164,7 +164,7 @@ write_ggtt_rotated(struct xe_bo *bo, struct xe_ggtt *ggtt, u32 *ggtt_ofs, u32 bo > u32 src_idx = src_stride * (height - 1) + column + bo_ofs; > > for (row = 0; row < height; row++) { > - u64 pte = ggtt->pt_ops->pte_encode_bo(bo, src_idx * XE_PAGE_SIZE, > + u64 pte = ggtt->pt_ops->pte_encode_bo(bo, src_idx * (u64)XE_PAGE_SIZE, > xe->pat.idx[XE_CACHE_WB]); > > xe_ggtt_set_pte(ggtt, *ggtt_ofs, pte); > @@ -381,4 +381,4 @@ struct i915_address_space *intel_dpt_create(struct intel_framebuffer *fb) > void intel_dpt_destroy(struct i915_address_space *vm) > { > return; > -} > \ No newline at end of file > +} > -- > 2.25.1
diff --git a/drivers/gpu/drm/xe/display/xe_fb_pin.c b/drivers/gpu/drm/xe/display/xe_fb_pin.c index 722c84a56607..c9d26345ae6e 100644 --- a/drivers/gpu/drm/xe/display/xe_fb_pin.c +++ b/drivers/gpu/drm/xe/display/xe_fb_pin.c @@ -29,7 +29,7 @@ write_dpt_rotated(struct xe_bo *bo, struct iosys_map *map, u32 *dpt_ofs, u32 bo_ u32 src_idx = src_stride * (height - 1) + column + bo_ofs; for (row = 0; row < height; row++) { - u64 pte = ggtt->pt_ops->pte_encode_bo(bo, src_idx * XE_PAGE_SIZE, + u64 pte = ggtt->pt_ops->pte_encode_bo(bo, src_idx * (u64)XE_PAGE_SIZE, xe->pat.idx[XE_CACHE_WB]); iosys_map_wr(map, *dpt_ofs, u64, pte); @@ -61,7 +61,7 @@ write_dpt_remapped(struct xe_bo *bo, struct iosys_map *map, u32 *dpt_ofs, for (column = 0; column < width; column++) { iosys_map_wr(map, *dpt_ofs, u64, - pte_encode_bo(bo, src_idx * XE_PAGE_SIZE, + pte_encode_bo(bo, src_idx * (u64)XE_PAGE_SIZE, xe->pat.idx[XE_CACHE_WB])); *dpt_ofs += 8; @@ -118,7 +118,7 @@ static int __xe_pin_fb_vma_dpt(struct intel_framebuffer *fb, u32 x; for (x = 0; x < size / XE_PAGE_SIZE; x++) { - u64 pte = ggtt->pt_ops->pte_encode_bo(bo, x * XE_PAGE_SIZE, + u64 pte = ggtt->pt_ops->pte_encode_bo(bo, x * (u64)XE_PAGE_SIZE, xe->pat.idx[XE_CACHE_WB]); iosys_map_wr(&dpt->vmap, x * 8, u64, pte); @@ -164,7 +164,7 @@ write_ggtt_rotated(struct xe_bo *bo, struct xe_ggtt *ggtt, u32 *ggtt_ofs, u32 bo u32 src_idx = src_stride * (height - 1) + column + bo_ofs; for (row = 0; row < height; row++) { - u64 pte = ggtt->pt_ops->pte_encode_bo(bo, src_idx * XE_PAGE_SIZE, + u64 pte = ggtt->pt_ops->pte_encode_bo(bo, src_idx * (u64)XE_PAGE_SIZE, xe->pat.idx[XE_CACHE_WB]); xe_ggtt_set_pte(ggtt, *ggtt_ofs, pte); @@ -381,4 +381,4 @@ struct i915_address_space *intel_dpt_create(struct intel_framebuffer *fb) void intel_dpt_destroy(struct i915_address_space *vm) { return; -} \ No newline at end of file +}
Multiplying XE_PAGE_SIZE with another u32 and the product stored in u64 can potentially lead to overflow. Change one of the value to u64 so as to perform 64 bit arithmetic operation as the product is u64. Signed-off-by: Arun R Murthy <arun.r.murthy@intel.com> --- drivers/gpu/drm/xe/display/xe_fb_pin.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)