From fe765fc4640881a131b26716d191ae3d52a2168a Mon Sep 17 00:00:00 2001 From: Vinod G Date: Tue, 15 Jan 2019 12:35:47 -0800 Subject: [PATCH] gpu: nvgpu: fix unintentional integer overflow issue Reported issue, potentially overflowing expression with type u32 is evaluated using 32bit arithmetic and then used in a context that expects an expression of type 64. Type cast the 32 bit to 64bit variable before applying the arithmetic left shift. Fix Coverity ID 8387800 Change-Id: I7a988eedf91f82b21b8bc6c35606d80cfb2d083b Signed-off-by: Vinod G Reviewed-on: https://git-master.nvidia.com/r/1995835 Reviewed-by: mobile promotions Tested-by: mobile promotions --- drivers/gpu/nvgpu/tu104/gr_tu104.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/nvgpu/tu104/gr_tu104.c b/drivers/gpu/nvgpu/tu104/gr_tu104.c index fda009412..7d0825f85 100644 --- a/drivers/gpu/nvgpu/tu104/gr_tu104.c +++ b/drivers/gpu/nvgpu/tu104/gr_tu104.c @@ -228,6 +228,8 @@ void gr_tu104_commit_gfxp_rtv_cb(struct gk20a *g, struct nvgpu_gr_ctx *gr_ctx, bool patch) { u64 addr; + u64 addr_lo; + u64 addr_hi; u32 rtv_cb_size; u32 gfxp_addr_size; @@ -240,11 +242,12 @@ void gr_tu104_commit_gfxp_rtv_cb(struct gk20a *g, gfxp_addr_size = gr_scc_rm_rtv_cb_size_div_256b_gfxp_adder_f(); /* GFXP RTV circular buffer */ - addr = (u64)(u64_lo32(gr_ctx->gfxp_rtvcb_ctxsw_buffer.gpu_va) >> - gr_scc_rm_rtv_cb_base_addr_39_8_align_bits_f()) | - (u64)(u64_hi32(gr_ctx->gfxp_rtvcb_ctxsw_buffer.gpu_va) << - (32U - gr_scc_rm_rtv_cb_base_addr_39_8_align_bits_f())); - + addr_lo = (u64)(u64_lo32(gr_ctx->gfxp_rtvcb_ctxsw_buffer.gpu_va) >> + gr_scc_rm_rtv_cb_base_addr_39_8_align_bits_f()); + addr_hi = (u64)(u64_hi32(gr_ctx->gfxp_rtvcb_ctxsw_buffer.gpu_va)); + addr = addr_lo | + (addr_hi << + (32U - gr_scc_rm_rtv_cb_base_addr_39_8_align_bits_f())); gr_tu104_commit_rtv_circular_buffer(g, gr_ctx, addr, rtv_cb_size,