nv-tegra-mirror/linux-nvgpu
1
0
Fork 0
mirror of git://nv-tegra.nvidia.com/linux-nvgpu.git synced 2025-12-24 10:34:43 +03:00
Code Issues Packages Projects Releases Wiki Activity

gpu: nvgpu: fix unintentional integer overflow issue

Browse Source 
Reported issue, potentially overflowing expression with type u32
is evaluated using 32bit arithmetic and then used in a context that
expects an expression of type 64.

Type cast the 32 bit to 64bit variable before applying the
arithmetic left shift.

Fix Coverity ID 8387800

Change-Id: I7a988eedf91f82b21b8bc6c35606d80cfb2d083b
Signed-off-by: Vinod G <vinodg@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1995835
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
This commit is contained in:
Vinod G
2019-01-15 12:35:47 -08:00
committed by mobile promotions
parent c0a2f356c4
commit fe765fc464
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/gpu/nvgpu/tu104/gr_tu104.c
View File

@@ -228,6 +228,8 @@ void gr_tu104_commit_gfxp_rtv_cb(struct gk20a *g,
struct nvgpu_gr_ctx *gr_ctx, bool patch)
{
u64 addr;
u64 addr_lo;
u64 addr_hi;
u32 rtv_cb_size;
u32 gfxp_addr_size;
@@ -240,11 +242,12 @@ void gr_tu104_commit_gfxp_rtv_cb(struct gk20a *g,
gfxp_addr_size = gr_scc_rm_rtv_cb_size_div_256b_gfxp_adder_f();
/* GFXP RTV circular buffer */
addr = (u64)(u64_lo32(gr_ctx->gfxp_rtvcb_ctxsw_buffer.gpu_va) >>
gr_scc_rm_rtv_cb_base_addr_39_8_align_bits_f()) |
(u64)(u64_hi32(gr_ctx->gfxp_rtvcb_ctxsw_buffer.gpu_va) <<
(32U - gr_scc_rm_rtv_cb_base_addr_39_8_align_bits_f()));
addr_lo = (u64)(u64_lo32(gr_ctx->gfxp_rtvcb_ctxsw_buffer.gpu_va) >>
gr_scc_rm_rtv_cb_base_addr_39_8_align_bits_f());
addr_hi = (u64)(u64_hi32(gr_ctx->gfxp_rtvcb_ctxsw_buffer.gpu_va));
addr = addr_lo |
(addr_hi <<
(32U - gr_scc_rm_rtv_cb_base_addr_39_8_align_bits_f()));
gr_tu104_commit_rtv_circular_buffer(g, gr_ctx, addr,
rtv_cb_size,