Skip to content

Commit d3d37f7

Browse files
Nikita Zhandarovichtursulin
authored andcommitted
drm/i915/guc: prevent a possible int overflow in wq offsets
It may be possible for the sum of the values derived from i915_ggtt_offset() and __get_parent_scratch_offset()/ i915_ggtt_offset() to go over the u32 limit before being assigned to wq offsets of u64 type. Mitigate these issues by expanding one of the right operands to u64 to avoid any overflow issues just in case. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Fixes: c2aa552 ("drm/i915/guc: Add multi-lrc context registration") Cc: Matthew Brost <matthew.brost@intel.com> Cc: John Harrison <John.C.Harrison@Intel.com> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> Link: https://patchwork.freedesktop.org/patch/msgid/20240725155925.14707-1-n.zhandarovich@fintech.ru Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> (cherry picked from commit 1f1c1bd) Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
1 parent da3ea35 commit d3d37f7

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2842,9 +2842,9 @@ static void prepare_context_registration_info_v70(struct intel_context *ce,
28422842
ce->parallel.guc.wqi_tail = 0;
28432843
ce->parallel.guc.wqi_head = 0;
28442844

2845-
wq_desc_offset = i915_ggtt_offset(ce->state) +
2845+
wq_desc_offset = (u64)i915_ggtt_offset(ce->state) +
28462846
__get_parent_scratch_offset(ce);
2847-
wq_base_offset = i915_ggtt_offset(ce->state) +
2847+
wq_base_offset = (u64)i915_ggtt_offset(ce->state) +
28482848
__get_wq_offset(ce);
28492849
info->wq_desc_lo = lower_32_bits(wq_desc_offset);
28502850
info->wq_desc_hi = upper_32_bits(wq_desc_offset);

0 commit comments

Comments
 (0)