From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lf1-f41.google.com (mail-lf1-f41.google.com [209.85.167.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 665D511CA9 for ; Mon, 8 Dec 2025 16:02:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765209774; cv=none; b=jOjoDsniUSZkGe2fmEMbKIobDqDNgbGAwrChSjEFMVz8ykNRVMDVSZjHgaPDmxIyUutwEr+iWQs8Fz4JCCZEQA+W7yh//NqnOQDsnzKPDggi5dOx9iU3ShsYRrgiLVHxvExlCrDHO9JsTDlYCbwwDkTpokSwPN1Ei6a/o6xh/SY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765209774; c=relaxed/simple; bh=bLJ/DxhuYtfghkD/xdLw9mssOsq58QXFAJcdNJ3qiKM=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=iuOkc9iYEMz9+ClVAkL5f36nYfYZZP0msZmby0wB7No6P+Nqm2xAXoa2U4fFa+guLE9GSoTE5iOzEg8d2/Fu+fSuGUDAhhBhIrj9J7llC1kSBb3H/xkhgY87B5Os0pCHeVwtXr7knwYjxAk7drJzH4uIRsZYRE/Rf3IUFo8/A0I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kgmOip7f; arc=none smtp.client-ip=209.85.167.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kgmOip7f" Received: by mail-lf1-f41.google.com with SMTP id 2adb3069b0e04-59445ee9738so3884365e87.3 for ; Mon, 08 Dec 2025 08:02:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1765209770; x=1765814570; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Im/UU88NzMzAmZTVyjewlopeNrCHZj8w4QA0s6ZSqCQ=; b=kgmOip7fcgvKvCvbyOIlEO9BfzLuns7QBPY4rk+h2OXvwcGqvKLSIMazwd3uYkABIs o8Ud99OY9QWp7Qgl8moYyrmDNDfL4E2xOjA+98GBNfTYj962smd3iQRGzPngc3gSOX+q GcmV7S2pKA711TRudKiAApBy51oK6kmbI0mfA1TTESmkAuGwqg1Kz+KqQDqMLiehcQvx PNIXGeqMzWpXISBugBMR6OColE/CuptLKPr2j4qfwpLxuA5HRCILX5KqfnQ5oVsJEoax JuDxz8/QiReuqgXyd57RZtazDBdNJmXdea3qnLOS1BC5bDAwnZQa7/tN7ejzIM5mRcX+ oU1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765209770; x=1765814570; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Im/UU88NzMzAmZTVyjewlopeNrCHZj8w4QA0s6ZSqCQ=; b=UAVh35A/yBXdnj3Q91DG45rBa18YincBGOEF1upgIUPxScnICrN1Do5HFTJErhsdas SJh6R9LZRVcWdaN5o8oh9bWNq/iDprt39dlfDrcjtXootYekKuy9LvxetvcP6OhcJBMn IHx9SUZd2hnPQMIXICxuJGEMiLTBFZYj7FWSfbmRJd/b1nSgMGysnekbd2bRorKbZ5b6 5hxmRCGT3H8Gv085SNmQnf0amVFTOrIQtzZ/KBPEXOlj58wIhRCTN/Xh/mfijBtUotY7 yXk/DGuuTesaqu8slxKhkpkHeiB3wnI65s+HN+d3TPEnpspS4cRX2aqkTcZ2fZp87M/e YvuA== X-Forwarded-Encrypted: i=1; AJvYcCWtMG26a8bRNeXmq7VwtKG/t8vCUuDHhHIYZKIGnBO+Q+R1pB/jQfe8R4MuV/yjgr7HELWvjnLTBZeqiM8=@vger.kernel.org X-Gm-Message-State: AOJu0YwFn+wJg0sRUj1txoO9gT3pGaqaOCaDl26t2kFoN801QVrV5LLq aEl4PTkWeU2XoLVdzEK/hX7wmyKrmdSy5fWPcXWO0/VoGAk3jINL2bEs X-Gm-Gg: ASbGncuWGjq/4IJ1Fhodrj7NZSOQ34iILSoSCbLXn/F3Xr2CfQgQUVNkB7GZ7w6ndwN n+dXyd0HF9wxU4bXaGKIG6dgjJ1SuSRdnVCVlE0jY9C0mzzYHPHQkLOcMwe42P1a5islqImG/3O juWSPGjKKQyA2xYheyzW7JyfoC9jlE8+uYSMNy1V+2caKVWRQZZ+GrHTI/9+paH5OjwMJvfZknR UCtOwiSqVEbbX3+6DOCN9jhvPza2qTY4SQBv8LizV3OE+uTj25Fj12Q+8e/Fg2+w4lyQXLzDpeT kz1At3XnYhRQA0yiTxnWGCJ8rN7Nf4sLgsk2zLp2V8G9EQcjMceU7zZmSFU0Pp6a0CyXuozOhNS epRt+ylfg2MoxGi68cV4R8a+Ee9xyQ4q4gHlvc/ALNrFG6imkOMu3Nq03aXM36vkjmX1DcQcb1Z 195IHEnds5aFniyauq0NANXx5RBbygAQdO++KQ/kCJ+F6QAQMQ X-Google-Smtp-Source: AGHT+IGl+2gac5WBQa4JRm/ES2jta48b8h2trd4DFOGKpZqgj+BulMqtAB1nSDlk9h7vcIXyCWxuow== X-Received: by 2002:a05:6512:e88:b0:595:81e5:7574 with SMTP id 2adb3069b0e04-5987e8c36c5mr2692786e87.20.1765209770098; Mon, 08 Dec 2025 08:02:50 -0800 (PST) Received: from home-server.lan (89-109-48-215.dynamic.mts-nn.ru. [89.109.48.215]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-597df2f7400sm2890827e87.35.2025.12.08.08.02.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 08 Dec 2025 08:02:49 -0800 (PST) From: Alexey Simakov To: David Airlie Cc: Alexey Simakov , Gerd Hoffmann , Dmitry Osipenko , Gurchetan Singh , Chia-I Wu , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Simona Vetter , Lingfeng Yang , dri-devel@lists.freedesktop.org, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org Subject: [PATCH] drm/virtio: fix undefined behavior in capset shift calculation Date: Mon, 8 Dec 2025 19:02:29 +0300 Message-Id: <20251208160228.13145-1-bigalex934@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit According to MAX_CAPSET_ID, possible values of vgdev->capsets[i].id range from 0 to 63. Since the intermediate calculation uses type int, shifting by values larger than the bit width of int is undefined behavior as per the C language standard. Explicitly cast the left-shift operand to ULL to prevent undefined behavior during the calculation. Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: 1925d6a7e0f4 ("drm/virtio: implement context init: track valid capabilities in a mask") Signed-off-by: Alexey Simakov --- drivers/gpu/drm/virtio/virtgpu_kms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c index 1c15cbf326b7..2e0ec7590ac2 100644 --- a/drivers/gpu/drm/virtio/virtgpu_kms.c +++ b/drivers/gpu/drm/virtio/virtgpu_kms.c @@ -104,7 +104,7 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev, return; } - vgdev->capset_id_mask |= 1 << vgdev->capsets[i].id; + vgdev->capset_id_mask |= 1ULL << vgdev->capsets[i].id; DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n", i, vgdev->capsets[i].id, vgdev->capsets[i].max_version, -- 2.34.1