* [PATCH] drm/virtio: fix undefined behavior in capset shift calculation
@ 2025-12-08 16:02 Alexey Simakov
2025-12-11 4:58 ` Dmitry Osipenko
0 siblings, 1 reply; 2+ messages in thread
From: Alexey Simakov @ 2025-12-08 16:02 UTC (permalink / raw)
To: David Airlie
Cc: Alexey Simakov, Gerd Hoffmann, Dmitry Osipenko, Gurchetan Singh,
Chia-I Wu, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann,
Simona Vetter, Lingfeng Yang, dri-devel, virtualization,
linux-kernel, lvc-project
According to MAX_CAPSET_ID, possible values of vgdev->capsets[i].id
range from 0 to 63. Since the intermediate calculation uses type int,
shifting by values larger than the bit width of int is undefined
behavior as per the C language standard.
Explicitly cast the left-shift operand to ULL to prevent undefined
behavior during the calculation.
Found by Linux Verification Center (linuxtesting.org) with Svace.
Fixes: 1925d6a7e0f4 ("drm/virtio: implement context init: track valid capabilities in a mask")
Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
---
drivers/gpu/drm/virtio/virtgpu_kms.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
index 1c15cbf326b7..2e0ec7590ac2 100644
--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
+++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
@@ -104,7 +104,7 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev,
return;
}
- vgdev->capset_id_mask |= 1 << vgdev->capsets[i].id;
+ vgdev->capset_id_mask |= 1ULL << vgdev->capsets[i].id;
DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n",
i, vgdev->capsets[i].id,
vgdev->capsets[i].max_version,
--
2.34.1
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] drm/virtio: fix undefined behavior in capset shift calculation
2025-12-08 16:02 [PATCH] drm/virtio: fix undefined behavior in capset shift calculation Alexey Simakov
@ 2025-12-11 4:58 ` Dmitry Osipenko
0 siblings, 0 replies; 2+ messages in thread
From: Dmitry Osipenko @ 2025-12-11 4:58 UTC (permalink / raw)
To: Alexey Simakov, David Airlie
Cc: Gerd Hoffmann, Gurchetan Singh, Chia-I Wu, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, Simona Vetter, Lingfeng Yang,
dri-devel, virtualization, linux-kernel, lvc-project
On 12/8/25 19:02, Alexey Simakov wrote:
> According to MAX_CAPSET_ID, possible values of vgdev->capsets[i].id
> range from 0 to 63. Since the intermediate calculation uses type int,
> shifting by values larger than the bit width of int is undefined
> behavior as per the C language standard.
>
> Explicitly cast the left-shift operand to ULL to prevent undefined
> behavior during the calculation.
>
> Found by Linux Verification Center (linuxtesting.org) with Svace.
>
> Fixes: 1925d6a7e0f4 ("drm/virtio: implement context init: track valid capabilities in a mask")
> Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
> ---
> drivers/gpu/drm/virtio/virtgpu_kms.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
> index 1c15cbf326b7..2e0ec7590ac2 100644
> --- a/drivers/gpu/drm/virtio/virtgpu_kms.c
> +++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
> @@ -104,7 +104,7 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev,
> return;
> }
>
> - vgdev->capset_id_mask |= 1 << vgdev->capsets[i].id;
> + vgdev->capset_id_mask |= 1ULL << vgdev->capsets[i].id;
> DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n",
> i, vgdev->capsets[i].id,
> vgdev->capsets[i].max_version,
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
--
Best regards,
Dmitry
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-12-11 4:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-12-08 16:02 [PATCH] drm/virtio: fix undefined behavior in capset shift calculation Alexey Simakov
2025-12-11 4:58 ` Dmitry Osipenko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®