| Message ID | 20230306090633.65918-1-geert+renesas@glider.be |
|---|---|
| State | Accepted |
| Commit | 4760be481dc075cd13f95f4650f5d5b53b4b336d |
| Headers | show |
| Series | drm/msm/dpu: Fix bit-shifting UB in DPU_HW_VER() macro | expand |
On 3/6/23 01:06, Geert Uytterhoeven wrote: > With gcc-5 and CONFIG_UBSAN_SHIFT=y: > > drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable': > drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant > case DPU_HW_VER_800: > ^ > drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant > case DPU_HW_VER_810: > ^ > drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant > case DPU_HW_VER_900: > ^ > > This happens because for major revisions 8 or greather, the non-sign bit > of the major revision number is shifted into bit 31 of a signed integer, > which is undefined behavior. > > Fix this by casting the major revision number to unsigned int. > > Fixes: efcd0107727c4f04 ("drm/msm/dpu: add support for SM8550") > Fixes: 4a352c2fc15aec1e ("drm/msm/dpu: Introduce SC8280XP") > Fixes: 100d7ef6995d1f86 ("drm/msm/dpu: add support for SM8450") > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Thanks. > --- > drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h > index ddab9caebb18c40d..bbd3cbdd77956c5d 100644 > --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h > +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h > @@ -19,8 +19,9 @@ > */ > #define MAX_BLOCKS 12 > > -#define DPU_HW_VER(MAJOR, MINOR, STEP) (((MAJOR & 0xF) << 28) |\ > - ((MINOR & 0xFFF) << 16) |\ > +#define DPU_HW_VER(MAJOR, MINOR, STEP) \ > + ((((unsigned int)MAJOR & 0xF) << 28) | \ > + ((MINOR & 0xFFF) << 16) | \ > (STEP & 0xFFFF)) > > #define DPU_HW_MAJOR(rev) ((rev) >> 28)
On Tue, Mar 21, 2023 at 8:08 AM Randy Dunlap <rdunlap@infradead.org> wrote: > > > > On 3/6/23 01:06, Geert Uytterhoeven wrote: > > With gcc-5 and CONFIG_UBSAN_SHIFT=y: > > > > drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable': > > drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant > > case DPU_HW_VER_800: > > ^ > > drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant > > case DPU_HW_VER_810: > > ^ > > drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant > > case DPU_HW_VER_900: > > ^ > > > > This happens because for major revisions 8 or greather, the non-sign bit > > of the major revision number is shifted into bit 31 of a signed integer, > > which is undefined behavior. > > > > Fix this by casting the major revision number to unsigned int. > > > > Fixes: efcd0107727c4f04 ("drm/msm/dpu: add support for SM8550") > > Fixes: 4a352c2fc15aec1e ("drm/msm/dpu: Introduce SC8280XP") > > Fixes: 100d7ef6995d1f86 ("drm/msm/dpu: add support for SM8450") > > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> > > Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Rob Clark <robdclark@gmail.com> > > Thanks. > > > --- > > drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 5 +++-- > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h > > index ddab9caebb18c40d..bbd3cbdd77956c5d 100644 > > --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h > > +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h > > @@ -19,8 +19,9 @@ > > */ > > #define MAX_BLOCKS 12 > > > > -#define DPU_HW_VER(MAJOR, MINOR, STEP) (((MAJOR & 0xF) << 28) |\ > > - ((MINOR & 0xFFF) << 16) |\ > > +#define DPU_HW_VER(MAJOR, MINOR, STEP) \ > > + ((((unsigned int)MAJOR & 0xF) << 28) | \ > > + ((MINOR & 0xFFF) << 16) | \ > > (STEP & 0xFFFF)) > > > > #define DPU_HW_MAJOR(rev) ((rev) >> 28) > > -- > ~Randy
On Mon, 06 Mar 2023 10:06:33 +0100, Geert Uytterhoeven wrote: > With gcc-5 and CONFIG_UBSAN_SHIFT=y: > > drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable': > drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant > case DPU_HW_VER_800: > ^ > drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant > case DPU_HW_VER_810: > ^ > drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant > case DPU_HW_VER_900: > ^ > > [...] Applied, thanks! [1/1] drm/msm/dpu: Fix bit-shifting UB in DPU_HW_VER() macro https://gitlab.freedesktop.org/lumag/msm/-/commit/c8f370bde5b9 Best regards,
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h index ddab9caebb18c40d..bbd3cbdd77956c5d 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h @@ -19,8 +19,9 @@ */ #define MAX_BLOCKS 12 -#define DPU_HW_VER(MAJOR, MINOR, STEP) (((MAJOR & 0xF) << 28) |\ - ((MINOR & 0xFFF) << 16) |\ +#define DPU_HW_VER(MAJOR, MINOR, STEP) \ + ((((unsigned int)MAJOR & 0xF) << 28) | \ + ((MINOR & 0xFFF) << 16) | \ (STEP & 0xFFFF)) #define DPU_HW_MAJOR(rev) ((rev) >> 28)
With gcc-5 and CONFIG_UBSAN_SHIFT=y: drivers/gpu/drm/msm/msm_mdss.c: In function 'msm_mdss_enable': drivers/gpu/drm/msm/msm_mdss.c:296:2: error: case label does not reduce to an integer constant case DPU_HW_VER_800: ^ drivers/gpu/drm/msm/msm_mdss.c:299:2: error: case label does not reduce to an integer constant case DPU_HW_VER_810: ^ drivers/gpu/drm/msm/msm_mdss.c:300:2: error: case label does not reduce to an integer constant case DPU_HW_VER_900: ^ This happens because for major revisions 8 or greather, the non-sign bit of the major revision number is shifted into bit 31 of a signed integer, which is undefined behavior. Fix this by casting the major revision number to unsigned int. Fixes: efcd0107727c4f04 ("drm/msm/dpu: add support for SM8550") Fixes: 4a352c2fc15aec1e ("drm/msm/dpu: Introduce SC8280XP") Fixes: 100d7ef6995d1f86 ("drm/msm/dpu: add support for SM8450") Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> --- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)