hw/misc: cast nand_getio value to uint64_t

Commit Message

Tigran Sogomonian Dec. 26, 2024, 2:16 p.m. UTC

s->buswidth = nand_flash_ids[s->chip_id].width >> 3;
<= 16 >> 3 <= 2.
x <= s->ioaddr[offset] << (s->buswidth << 3)
<= max_uint8_t << 16
With x << 24 overflow is possible.
Other cases are similar.
Thus, need to cast return value to uint64_t.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Tigran Sogomonian <[e-mail]>
---
 hw/misc/omap_gpmc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Alex Bennée Dec. 26, 2024, 10:49 p.m. UTC | #1

Tigran Sogomonian <[e-mail]> writes:

> s->buswidth = nand_flash_ids[s->chip_id].width >> 3;
> <= 16 >> 3 <= 2.
> x <= s->ioaddr[offset] << (s->buswidth << 3)
> <= max_uint8_t << 16
> With x << 24 overflow is possible.
> Other cases are similar.
> Thus, need to cast return value to uint64_t.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Signed-off-by: Tigran Sogomonian <[e-mail]>

This code was removed in 192f75ad11 (hw/misc: Remove omap_gpmc)

Patch

diff --git a/hw/misc/omap_gpmc.c b/hw/misc/omap_gpmc.c
index 67158eb164..b0a48c71de 100644
--- a/hw/misc/omap_gpmc.c
+++ b/hw/misc/omap_gpmc.c
@@ -139,8 +139,8 @@  static uint64_t omap_nand_read(void *opaque, hwaddr addr,
         if (size == 2) {
             return v;
         }
-        v |= (nand_getio(f->dev) << 16);
-        v |= (nand_getio(f->dev) << 24);
+        v |= ((uint64_t)nand_getio(f->dev) << 16);
+        v |= ((uint64_t)nand_getio(f->dev) << 24);
         return v;
     case OMAP_GPMC_16BIT:
         v = nand_getio(f->dev);
@@ -151,7 +151,7 @@  static uint64_t omap_nand_read(void *opaque, hwaddr addr,
         if (size == 2) {
             return v;
         }
-        v |= (nand_getio(f->dev) << 16);
+        v |= ((uint64_t)nand_getio(f->dev) << 16);
         return v;
     default:
         abort();