diff mbox

i915: cast before shifting in i915_pte_count

Message ID 20160217142043.4947.60447.stgit@localhost.localdomain (mailing list archive)
State New, archived
Headers show

Commit Message

Alan Cox Feb. 17, 2016, 2:20 p.m. UTC
Otherwise a pde_shift big enough to overflow a u32 will be truncated before
assignment

Signed-off-by: Alan Cox <alan@linux.intel.com>
---
 drivers/gpu/drm/i915/i915_gem_gtt.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Daniel Vetter Feb. 17, 2016, 4 p.m. UTC | #1
On Wed, Feb 17, 2016 at 02:20:46PM +0000, Alan wrote:
> Otherwise a pde_shift big enough to overflow a u32 will be truncated before
> assignment
> 
> Signed-off-by: Alan Cox <alan@linux.intel.com>

Applied to drm-intel-next-queued, with a note why we never hit this bug
currently. But the units here are quite confused ...
-Daniel

> ---
>  drivers/gpu/drm/i915/i915_gem_gtt.h |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.h b/drivers/gpu/drm/i915/i915_gem_gtt.h
> index 66a6da2..368d111 100644
> --- a/drivers/gpu/drm/i915/i915_gem_gtt.h
> +++ b/drivers/gpu/drm/i915/i915_gem_gtt.h
> @@ -418,7 +418,7 @@ static inline uint32_t i915_pte_index(uint64_t address, uint32_t pde_shift)
>  static inline uint32_t i915_pte_count(uint64_t addr, size_t length,
>  				      uint32_t pde_shift)
>  {
> -	const uint64_t mask = ~((1 << pde_shift) - 1);
> +	const uint64_t mask = ~((1ULL << pde_shift) - 1);
>  	uint64_t end;
>  
>  	WARN_ON(length == 0);
> 
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel
diff mbox

Patch

diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.h b/drivers/gpu/drm/i915/i915_gem_gtt.h
index 66a6da2..368d111 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.h
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.h
@@ -418,7 +418,7 @@  static inline uint32_t i915_pte_index(uint64_t address, uint32_t pde_shift)
 static inline uint32_t i915_pte_count(uint64_t addr, size_t length,
 				      uint32_t pde_shift)
 {
-	const uint64_t mask = ~((1 << pde_shift) - 1);
+	const uint64_t mask = ~((1ULL << pde_shift) - 1);
 	uint64_t end;
 
 	WARN_ON(length == 0);